Residential Proxy Networks Fuel Abuse and Expose Home and Enterprise Users

Security researchers reported that residential proxy networks are increasingly being used to route malicious traffic through legitimate home internet connections, helping attackers evade IP reputation controls while making abuse appear to come from ordinary consumers and organizations. Infoblox said more than 65% of its cloud customers queried domains tied to residential proxy services in 2026, with monthly DNS traffic rising from roughly 300–400 billion queries in early 2025 to more than 500 billion by April 2026, affecting every industry vertical examined, including healthcare, pharmaceuticals, banking, government, electronics, food and beverage, and industrial sectors. The company also observed no meaningful drop after disruption efforts against IPIDEA, and recorded a 265% single-day spike in queries to ipinfo[.]ipidea[.]io on January 23.

Separate telemetry from Gen Digital linked residential proxy traffic to 7.4 million malicious incidents affecting 572,000 users since January 2026, with notable concentration in India, Vietnam, and Brazil. Researchers said devices are often enrolled through pay-for-bandwidth apps, free VPNs, browser extensions, bundled SDKs, preinstalled Android TV software, IoT devices, malware, and potentially unwanted applications, sometimes without clear user consent. The reports warn that these networks are being used for phishing, credential stuffing, account takeover, ad fraud, scams, scraping, and reconnaissance, while shifting legal, reputational, and performance risks onto households and enterprises whose IP addresses become exit nodes. Recommended mitigations include Protective DNS, DNS log reviews, auditing apps and browser extensions for embedded proxy components, inspecting connected devices, and removing unknown or suspicious software.