Datacenter blocklists are still the default proxy defence in a lot of fraud stacks. The addresses showing up in proxy supply this week mostly were not in datacenters.

Between 23–29 October 2026 (UTC) , the IP99 risk feed captured 10,930,592 proxy exit addresses it had not seen in the previous 7 days ( −4% vs the prior week). Source page: ip99.com/en/proxy-exits (generated 30 Oct 2026 UTC).

What those addresses sit on

Usage type Addresses Share

Residential broadband 8,701,207 79.6%

Mobile network 1,425,387 13.0%

Gateway / NAT egress 488,101 4.5%

Datacenter 240,834 2.2%

Education network 47,096 0.4%

Unclassified 27,967 0.3%

About 62% were rated high-risk at the moment of capture. The rest still carried a proxy-class signal at a lower risk level.

IP99 counts an address as "captured" when it enters the feed with a proxy-class signal ( proxy , VPN , dial-up pool, cloud phone, or hijacked shared proxy) and was not in the live 7-day risk mirror. Addresses that go quiet and return can be counted again.…