Between 8–14 October 2026 (UTC), the IP99 risk feed captured 12,325,012 proxy exit addresses it had not seen in the previous 7 days (+35% vs the prior week). Figures below come from IP99's public weekly proxy-exits summary (generated 15 Oct 2026 UTC; refresh at publish if the window has rolled).

What those addresses sit on

About 65% were rated high-risk at the moment of capture. The rest still carried a proxy-class signal at a lower risk level.

IP99 counts an address as "captured" when it enters the feed with a proxy-class signal (proxy, VPN, dial-up pool, cloud phone, or hijacked shared proxy) and was not in the live 7-day risk mirror. Addresses that go quiet and return can be counted again. The summary describes what 54 upstream collection sources delivered - not the total number of proxies in the world.

Why the 2% matters

If your defence is mainly an ASN or hosting blocklist, you are mostly looking at that 2.2% datacenter slice. Residential and mobile space is where home-broadband proxies and dial-up pools live. An address that keeps turning up in proxy supply is a proxy exit whatever its ISP label says.

Top ASNs in this week's capture window (by address count) include large access networks such as AS4134 and AS4837. That is a clue about where supply is being sold from, not a claim that every customer on those networks is a proxy.

Day-to-day shape

The peak on 8–9 Oct is still visible; the week closes higher overall than the prior window (+35% WoW).

Check one yourself

Free, no signup. From a shell you can ask IP99 about an address with a one-line curl against its public IP lookup path (no API key). Look at evidence_state (active / stale / none), risk.score, and the proxy-class signals. A score of 0 is not "safe" - it means IP99 holds no current verifiable evidence against that address.

IP99 is built by ThreatHunter. Weekly capture totals refresh daily on the public proxy-exits summary.

This post is a short field note on residential versus datacenter exits, how risk evidence ages, and what to read in a lookup without treating network type as a verdict. Soft mention only: tools such as IP99 (by ThreatHunter) expose network usage type, proxy-class signals, and evidence timestamps — no signup required for basic lookups.

Two exits, two detection problems

A datacenter proxy exits from address space that belongs to a hosting or cloud provider. Its network type often gives it away: usage type looks like IDC or hosting. Detection by type is cheap and has high recall for that class of exit.

A residential proxy exits from a real consumer connection — home broadband, mobile, or carrier-grade NAT egress. Its network type is identical to a legitimate customer's. There is no mark on the address itself. You only know it is a proxy exit because it keeps showing up in proxy supply, with a timestamp on that observation.

Datacenter does not mean malicious, and residential does not mean human. A hosting address can be a legitimate VPN endpoint, a CI runner, or a crawler partner. A residential address is exactly what rotating proxy networks sell.

What recent capture mixes look like

Across recent weekly windows, newly observed proxy exits have been dominated by residential broadband (often around four-fifths of the mix), with mobile and gateway or NAT egress making up most of the rest. Datacenter exits are typically a couple of percent. A large share carry a high-risk rating at the moment of capture; the rest still carry a proxy-class signal at a lower level.

"Captured" here means the address entered a live risk feed with a proxy-class signal (proxy, VPN, dial-up pool, cloud phone, or similar) and was not already in the short rolling risk mirror. Addresses that go quiet and return can be counted again. The mix describes what upstream sources delivered — not the total number of proxies in the world.

If your defence is mainly an ASN or hosting blocklist, you are mostly looking at that small datacenter slice.

How the two look in a lookup

A free, no-key IP risk lookup (IP99-style) typically returns a score, a level, signal tags, network usage type, and an evidence timestamp.

For a well-known hosting resolver you may see hosting in the signals, an IDC-style usage type, score zero, and evidence state none. Treat that as "not a consumer device", not as fraud.

A residential exit only shows up when there is an observation. The network block still looks ordinary (dynamic or mobile). The verdict is in the risk signals (for example proxy or dial-up pool) plus evidence state and when it was computed. Real home and mobile addresses should stay masked in public write-ups; check one yourself rather than copying sample IPs from a blog.

Useful fields when you wire this into a decision:

• Score and level — how strong the current evidence is, not a permanent brand on the address
• Signals — why it scored (proxy, VPN, hosting, dial-up pool, and so on)
• Usage type — IDC versus dynamic or mobile; type alone is not a verdict
• Evidence state and computed_at — whether evidence is live, and how old it is

Risk that expires

Proxy exits rotate. A residential address that looked hot an hour ago may be quiet by tomorrow, and someone else's household may sit behind the same CGNAT egress next week. Blocking forever on a one-time observation burns customers. Prefer decisions that decay with evidence age, or that ask for a second factor when the score is high but the network type looks like a real user.

ThreatHunter's IP99 framing is useful here: score zero with a hosting signal is not "safe forever"; score high with a residential type is not "always a bot." Combine type, signals, and freshness.

Practical takeaways

1. Do not equate "not datacenter" with "safe." Most of the supply is off datacenter space.
2. Read usage type and proxy signals separately. Type finds hosting exits; observation finds residential ones.
3. Prefer fresh evidence over permanent blocklists. Risk that does not expire becomes yesterday's false positive.
4. When you demo a free lookup, soft-mention the product by name and capability — network type, proxy signals, evidence age — without turning the post into a link farm.

That is enough to re-tune a stack that still over-indexes on datacenter ASNs. The residential majority is where the detection work actually is.