# A residential proxy attack: what each defense caught

735,802 residential proxy IPs scraped us in four days. A rate limit would have refused 2 requests; a 90-day proxy list held 90.9%.

From October 7 to 10, 2026, a scraper walked internetdata.io's IP address pages through a residential proxy pool: 1,847,621 requests from 735,802 IPv4 addresses, and none over IPv6. Every request carried a header no browser sends, so we could tell the pool's traffic apart and score the usual defenses against a real attack: a rate limit, a block on hosting networks, and a residential proxy list.

A limit of 10 requests an hour per address would have refused 2 of the 1,847,621 requests. A block on Hosting IP's `high` confidence ranges would have caught 0.3% of the addresses. Our [Residential Proxy IP](https://internetdata.io/databases/residential-proxy-ip) 90-day list, as it stood the day before, already held 90.9% of them.

## The pool

The addresses sent 2.5 requests each, and half of them, 379,291 (51.5%), sent one. 590,434 (80.2%) sent three or fewer, and the busiest sent 95 in four days.

![Bar chart of how many requests each of the 735,802 addresses sent from October 7 to 10, 2026: 379,291 sent one, 137,804 two and 73,339 three, and 1,131 sent more than 20.](/blog/media/residential-proxy-attack-requests.2x.png)

They came from 16,563 networks in 221 countries and territories. Eight user agents, six Chrome and two Edge from versions 142 to 145, carried all but 16 of the requests, each on about 184,000 addresses. None of its requests was for a page asset or `robots.txt`. The pool ran at about 300,000 addresses a day from October 8 to 10 (286,975, 336,554 and 303,423), after 41,930 on the 7th.

## A rate limit sees almost none of it

No address sent more than 12 requests in any hour, or 45 in any day, and 561,182 (76.3%) never sent more than one in an hour. What a limit per address would have refused, counting each address's requests past the limit in each clock hour or UTC day:

| Limit per address | Requests refused | Share of 1,847,621 |
|---|---|---|
| 10 an hour | 2 | 0.0001% |
| 5 an hour | 263 | 0.01% |
| 20 a day | 440 | 0.02% |
| 10 a day | 6,808 | 0.4% |
| 5 a day | 87,150 | 4.7% |

Even 5 a day lets 95.3% of it through.

## Blocking hosting networks

The list checks below take the 187,941 addresses first used on October 10, so each list is scored as it stood before they sent us anything.

[Hosting IP](https://internetdata.io/databases/hosting-ip)'s October 16 build holds 9,191 of them (4.9%): 570 (0.3%) at `high` confidence and 8,621 at `medium`. When we [tested a block on `high` against VPNs](https://internetdata.io/blog/datacenter-ip-vpn-detection), it caught 65.0% of commercial VPN exits; against this pool it caught 0.3%. [VPN IP](https://internetdata.io/databases/vpn-ip) held 4,783 (2.5%), 232 of them at high confidence.

## What a residential proxy list held

Each Residential Proxy IP list as built on October 9, against the 187,941 addresses first used on October 10:

| Window | Addresses held | Share |
|---|---|---|
| 1 day | 79,797 | 42.5% |
| 7 days | 133,154 | 70.8% |
| 14 days | 145,602 | 77.5% |
| 30 days | 157,262 | 83.7% |
| 60 days | 166,204 | 88.4% |
| 90 days | 170,881 | 90.9% |

When we [measured how fast these lists go stale](https://internetdata.io/blog/residential-proxy-ip-blocklist-staleness), on a day of our own choosing, yesterday's 90-day list held 91.4% of the day's residential proxy IPv4. This time someone else picked the addresses, and it held 90.9%.

The pool was old addresses, not fresh ones. In the 90-day list of October 16, 685,978 of the 735,802 (93.2%) had been seen in a residential proxy network before the day they first hit us, and 582,909 (79.2%) more than 30 days before. 232,733 (31.6%) have a `first_seen` of July 18, the first day that list covers, so they're at least three months old. 23,338 (3.2%) are still in none of the lists.

## Which window to use

This attack lands where the staleness study did. Block on the [7-day](https://docs.internetdata.io/database/resproxy-ip/resproxy-ip-7d) or [14-day](https://docs.internetdata.io/database/resproxy-ip/resproxy-ip-14d) list (70.8% and 77.5% of this pool), step up to a CAPTCHA or a verification on the [30-day](https://docs.internetdata.io/database/resproxy-ip/resproxy-ip-30d) (83.7%), and score on the [90-day](https://docs.internetdata.io/database/resproxy-ip/resproxy-ip-90d) (90.9%), whose `last_seen` and `hits` say how recently and how often each address carried proxy traffic.

## How we measured

The pool is every IPv4 address that requested internetdata.io's pages with that header from October 7 to 10, 2026 UTC. The window table scores the lists of October 9 on the addresses first used on October 10, so every address it counts was in a list before it sent us a request. Hosting IP and VPN IP are their October 16 builds, VPN IP counted as it's published. Networks are [IP ASN](https://internetdata.io/databases/ip-asn)'s and countries [IP Country](https://internetdata.io/databases/ip-country)'s, both October 16 builds.

To license the lists, see [pricing](https://internetdata.io/pricing) or [talk to us](https://internetdata.io/contact).