Datacenter blocklists are still the default proxy defence in a lot of fraud stacks. The addresses showing up in proxy supply this week mostly were not in datacenters.

Between 26 October – 1 November 2026 (UTC) , the IP99 risk feed captured 10,256,050 proxy exit addresses it had not seen in the previous 7 days ( −11% vs the prior week). Source page: ip99.com/en/proxy-exits (generated 2 Nov 2026 UTC).

What those addresses sit on

Usage type Addresses Share

Residential broadband 8,141,209 79.4%

Mobile network 1,368,798 13.3%

Gateway / NAT egress 467,034 4.6%

Datacenter 205,624 2.0%

Education network 47,673 0.5%

Unclassified 25,712 0.3%

About 62% were rated high-risk at the moment of capture. The rest still carried a proxy-class signal at a lower risk level.

IP99 counts an address as "captured" when it enters the feed with a proxy-class signal ( proxy , VPN , dial-up pool, cloud phone, or hijacked shared proxy) and was not in the live 7-day risk mirror.…