Proxy exit addresses captured this week

Between 22–28 October 2026 (UTC), the IP99 risk feed captured 11,196,585 proxy exit addresses it had not seen in the previous 7 days (+1% vs. the previous 7 days). By usage type the addresses were 80% residential broadband, 13% mobile network and 4% gateway / NAT egress. 62% of them were rated high-risk at the moment of capture; the remaining 38% carried a proxy signal at a lower risk level.

A captured address is one that entered the IP99 risk feed carrying a proxy-class signal (proxy, VPN, dial-up pool, cloud phone or hijacked shared proxy) and had not been in the live IP99 risk mirror during the previous 7 days — an address that goes quiet and returns is counted again. Every figure below counts distinct addresses over the last 7 complete UTC days, is refreshed daily, and describes what 68 upstream collection sources delivered — not the total number of proxies in the world. No address lists are published here.

What the captured addresses are made of

Usage type of the address space each captured address sits in. Residential broadband and mobile space is where home-broadband proxies and dial-up pools live; datacenter space is where hosting-based proxies and VPN exits live.

Which networks the captured addresses sit in

Autonomous system of each captured address. A network that keeps appearing here is one whose address space is being resold as proxy exits — whatever its usage type says.

Day by day

Captured: addresses that entered the feed that day with a proxy-class signal and had not been seen in the previous 7 days. Rated high-risk: those captured at high risk level. The last 7 rows are this week's window; the 7 before are the comparison.

How this is measured

The IP99 risk feed is fed by 68 upstream collection sources and pushes new evidence every 10 seconds. Each row that carries a proxy-class signal is checked against the live risk mirror, which keeps 7 days of evidence: if the address was not there, it counts as captured that day. An address is counted once per window. Rated high-risk at capture means the risk level attached to the row was high at that moment; the rest carried a proxy signal with a lower level. Usage type and country come with the row; ASN comes from the IP99 geolocation database. Source names are not published.

Check an address yourself

Free, no signup: curl https://ip99.com/v1/ip/8.8.8.8. The response's evidence_state says whether the address carries proxy evidence and how fresh it is — see what an IP risk score means and the API documentation. Go deeper: Rotating residential proxies and dial-up pools · How to detect a proxy, VPN or datacenter IP · IP ranges by autonomous system.

FAQ

How many proxy exit addresses are captured each week?

In the 7 days to 28 October 2026, the IP99 risk feed captured 11,196,585 proxy exit addresses it had not seen in the previous 7 days, 80% of them in residential broadband space. That is what the feed captured, not the total population of proxies, which no one can count.

Which countries have the most residential proxy exits?

the IP99 risk feed.

Are residential proxy exits detectable?

Yes, by observation rather than by address type: an address that keeps turning up in proxy supply is a proxy exit whatever its ISP says. 62% of the addresses captured this week were rated high-risk at the moment of capture; a lookup reports the evidence and its age as evidence_state. See rotating residential proxies and dial-up pools.

How often is this page updated?

Daily. The window is the last 7 complete UTC days; the figures here cover 22–28 October 2026 and were generated on 29 October 2026 UTC.