Researchers from GreyNoise analyzed 4 billion malicious sessions and found that residential proxies evaded IP reputation checks in 78% of cases, challenging the assumption that attackers can be distinguished from legitimate users based on IP origin. These proxies are short-lived, rapidly rotated, and primarily used for scanning and reconnaissance, making IP reputation less effective and suggesting a shift toward behavior-based detection methods.
Residential Proxies Evaded IP Reputation Checks in 78% of 4B Sessions
