Skip to main content
IPinfo - Comprehensive IP address data, IP geolocation API and database
New Research · IPIDEA Case Study

Inside the Residential Proxy Underground

When Google disrupted IPIDEA in January 2026, the world's largest residential proxy network, the takedown removed one storefront. The infrastructure stayed. A network-level look at how the ecosystem rebuilt itself, and what that means for detection.

Download Free White PaperPreview the Findings

Built on IPinfo's ResProxy Detection, continuous monitoring of 110+ proxy provider networks.

IPinfo Research
White Paper · 2026

Inside the Residential Proxy UndergroundHow shared infrastructure powers proxy ecosystems

ipinfo.io
92.7%
cross-provider IP overlap
12 brands
one shared backend (AS132203)
39%
of unique IPs targeting enterprise infrastructure originate in the residential proxy space
9–11M
daily active residential proxies in IPIDEA alone before disruption
550+
distinct threat groups used IPIDEA in a single week
46%
of all proxy IPs appear in more than one provider's network simultaneously
A Preview of what's inside

Three findings that reshape how you detect residential proxy traffic.

These are three of the report's data findings. The full white paper also covers what residential proxies are, how the supply chain actually works, and why traditional IP reputation falls short, before getting into the data behind 110+ proxy provider networks tracked before, during, and after Google's January 2026 disruption of IPIDEA.

Finding 01 • Shared Inventory

Independent brands, identical IPs.

Across every observation window since Q3 2025, roughly 9 out of 10 IPs in the IPIDEA network appear simultaneously inside other “competing” residential proxy providers, confirming a structurally shared device pool.

  • 44.7M IPv4 addresses observed across IPIDEA's brands since Q3 2025
  • 10 affiliated brands share >79% of inventory with IPIDEA
  • 46% of all proxy IPs across the broader ecosystem appear in multiple providers simultaneously
Source: IPinfo ResProxy Detection, Table 2 & 3, IPv4 cross-provider overlap, Q3 2025 – Jan 2026.
IPv4 Overlap with IPIDEA
0.0%
Cross-provider
Total IPs in IPIDEA39.9M
Also seen on other providers36.7M
Exclusive to IPIDEA3.2M
Top 10 brands by IP overlap with IPIDEA
1Provider 1
85.7%
2Provider 2
84.9%
3Provider 3
84.8%
4Provider 4
84.3%
5Provider 5
84.1%
6Provider 6
82.8%
7Provider 7
81.9%
8Provider 8
81.5%
9Provider 9
80.8%
10Provider 10
79.8%
Get the full report

Download the residential proxy detection white paper.

Get the 17-page research report with the full backend hosting map, the complete IPIDEA case-study timeline, methodology, and a practical guide to which IP intelligence signals actually identify residential proxy traffic.

  • Primer on residential proxies How they work, who buys them, and why they're indistinguishable from legitimate consumer traffic
  • Full IPIDEA case study Day-by-day timeline of the takedown, outage, and ecosystem regeneration
  • Backend hosting map Top 29 ASNs hosting 104 tracked proxy provider endpoints
  • The detection shift Why IP reputation alone fails, and what to replace it with
  • SOC, fraud, ad-tech playbooks Where IPinfo's data fits in your detection stack

Frequently Asked Questions

  • Traditional IP reputation systems rely on static labels, historical abuse data, and third-party feeds. Residential proxy IPs rotate rapidly, disappear before they can be flagged, and reappear across multiple provider networks, behaviors that static reputation models were never designed to track.

    Because these systems classify IPs based on what they claim to be rather than how they behave, they cannot keep pace with residential proxy infrastructure.

  • Residential proxy providers frequently share overlapping infrastructure, IP ranges, and backend systems across their networks. Understanding one provider's footprint can reveal detection signals that apply across multiple networks.

    Our research into the IPIDEA ecosystem, one of the largest residential proxy networks ever analyzed, showcases how shared infrastructure patterns can be mapped and used for more reliable detection. In the data behind this paper, twelve "competing" brands all routed traffic through the same autonomous system.

  • Effective residential proxy detection relies on behavioral signals derived from continuous observation: IP behavior patterns, rotation cadences, and session characteristics measured across the internet.

    Rather than relying on what an IP claims to be, our IP intelligence identifies residential proxy activity by observing how IPs actually behave across continuously monitored provider networks.

  • Behavioral IP intelligence is built on continuous observation and verification of IP infrastructure, rather than static datasets or third-party feeds.

    Where static IP reputation classifies addresses based on historical labels, behavioral intelligence observes how IPs act across the internet over time, capturing rotation patterns, session behaviors, and infrastructure relationships that static systems cannot see.

Residential Proxy Infrastructure Research | IPinfo