On this page
From October 7 to 10, 2026, a scraper walked internetdata.io's IP address pages through a residential proxy pool: 1,847,621 requests from 735,802 IPv4 addresses, and none over IPv6. Every request carried a header no browser sends, so we could tell the pool's traffic apart and score the usual defenses against a real attack: a rate limit, a block on hosting networks, and a residential proxy list.
A limit of 10 requests an hour per address would have refused 2 of the 1,847,621 requests. A block on Hosting IP's high confidence ranges would have caught 0.3% of the addresses. Our Residential Proxy IP 90-day list, as it stood the day before, already held 90.9% of them.
The pool
The addresses sent 2.5 requests each, and half of them, 379,291 (51.5%), sent one. 590,434 (80.2%) sent three or fewer, and the busiest sent 95 in four days.
They came from 16,563 networks in 221 countries and territories. Eight user agents, six Chrome and two Edge from versions 142 to 145, carried all but 16 of the requests, each on about 184,000 addresses. None of its requests was for a page asset or robots.txt. The pool ran at about 300,000 addresses a day from October 8 to 10 (286,975, 336,554 and 303,423), after 41,930 on the 7th.
A rate limit sees almost none of it
No address sent more than 12 requests in any hour, or 45 in any day, and 561,182 (76.3%) never sent more than one in an hour. What a limit per address would have refused, counting each address's requests past the limit in each clock hour or UTC day:
| Limit per address | Requests refused | Share of 1,847,621 |
|---|---|---|
| 10 an hour | 2 | 0.0001% |
| 5 an hour | 263 | 0.01% |
| 20 a day | 440 | 0.02% |
| 10 a day | 6,808 | 0.4% |
| 5 a day | 87,150 | 4.7% |
Even 5 a day lets 95.3% of it through.
Blocking hosting networks
The list checks below take the 187,941 addresses first used on October 10, so each list is scored as it stood before they sent us anything.
Hosting IP's October 16 build holds 9,191 of them (4.9%): 570 (0.3%) at high confidence and 8,621 at medium. When we tested a block on high against VPNs, it caught 65.0% of commercial VPN exits; against this pool it caught 0.3%. VPN IP held 4,783 (2.5%), 232 of them at high confidence.
What a residential proxy list held
Each Residential Proxy IP list as built on October 9, against the 187,941 addresses first used on October 10:
| Window | Addresses held | Share |
|---|---|---|
| 1 day | 79,797 | 42.5% |
| 7 days | 133,154 | 70.8% |
| 14 days | 145,602 | 77.5% |
| 30 days | 157,262 | 83.7% |
| 60 days | 166,204 | 88.4% |
| 90 days | 170,881 | 90.9% |
When we measured how fast these lists go stale, on a day of our own choosing, yesterday's 90-day list held 91.4% of the day's residential proxy IPv4. This time someone else picked the addresses, and it held 90.9%.
The pool was old addresses, not fresh ones. In the 90-day list of October 16, 685,978 of the 735,802 (93.2%) had been seen in a residential proxy network before the day they first hit us, and 582,909 (79.2%) more than 30 days before. 232,733 (31.6%) have a first_seen of July 18, the first day that list covers, so they're at least three months old. 23,338 (3.2%) are still in none of the lists.
Which window to use
This attack lands where the staleness study did. Block on the 7-day or 14-day list (70.8% and 77.5% of this pool), step up to a CAPTCHA or a verification on the 30-day (83.7%), and score on the 90-day (90.9%), whose last_seen and hits say how recently and how often each address carried proxy traffic.
How we measured
The pool is every IPv4 address that requested internetdata.io's pages with that header from October 7 to 10, 2026 UTC. The window table scores the lists of October 9 on the addresses first used on October 10, so every address it counts was in a list before it sent us a request. Hosting IP and VPN IP are their October 16 builds, VPN IP counted as it's published. Networks are IP ASN's and countries IP Country's, both October 16 builds.
To license the lists, see pricing or talk to us.
