Residential proxies undermine IP reputation systems, researchers warn

Residential proxies are posing a significant challenge to IP reputation systems, making it difficult to distinguish between malicious actors and legitimate users. This issue arises because residential proxies are often short-lived, inconsistently used, or systematically rotated, preventing defense systems from effectively cataloging and flagging them in time, with further coverage provided by Bleeping Computer.

A recent analysis by GreyNoise, examining 4 billion malicious sessions, found that approximately 39% originated from home networks, likely part of residential proxy networks. Alarmingly, 78% of these sessions were invisible to existing reputation feeds. The study revealed that most residential IPs are used only once or twice before being rotated, with 89.7% active for less than a month. Attackers leverage this rapid rotation across 683 different internet service providers to evade detection. While primarily used for network scanning and reconnaissance, some instances involved targeting enterprise VPNs and credential stuffing attempts. China, India, and Brazil are identified as major sources of this traffic.

The widespread abuse of residential proxies necessitates a shift in security strategies, moving away from solely relying on IP reputation. Researchers recommend focusing on behavioral analysis, such as detecting sequential probing from rotating IPs and tracking device fingerprints that persist beyond IP changes. Blocking illegitimate protocols from ISP spaces is also advised. The resilience of these proxy networks was highlighted by the disruption of IPIDEA, which saw its capacity quickly replaced by other providers.

Source: Bleeping Computer