- Monthly query volume to those domains grew roughly 25% between January 2025 and April 2026, reaching over 500 billion queries per month.
- Residential proxy traffic appeared in every industry vertical examined, with at least 40% of customers in each sector affected.
- Over 90% of pharmaceutical and food and beverage customers showed such traffic; more than 60% of government and banking customers did as well.
- Brightdata, the most prevalent service observed, appeared in over 50% of cloud customer networks.
- Grass, a cryptocurrency-paying proxy service, appeared in roughly 30% of customer networks.
- A 265% single-day spike in affected customer networks querying IPIDEA domains occurred around the time Google disrupted that service in January 2026.
“We’ve got over approximately 65% of our cloud customers making connections to residential proxy services, which is kind of crazy,” Renée Burton, vice president of threat intelligence at Infoblox, told Network World. “We’re a company that’s got enterprises, governments, banks, car companies, police departments, and 65% making those connections is a very high number.”
How residential proxies get into enterprise networks
A residential proxy routes internet traffic through consumer devices, including home routers, mobile phones, IoT devices, and applications with embedded proxy software. Unlike commercial VPNs or anonymization tools like Tor, which signal to destination sites that a connection is masked, residential proxies make traffic appear to originate from a specific real consumer device. The destination has no indication the connection is not what it appears to be.
The entry point into enterprise networks is the device itself. Employees connecting personal phones or laptops to corporate Wi-Fi bring any proxy software already running on those devices onto the network. Corporate devices can carry proxy SDKs embedded in consumer applications installed by the user. IoT devices deployed in corporate environments, including media streaming boxes or digital picture frames, may arrive with proxy software pre-installed or receive it through a firmware update.
The software typically enters devices through SDKs that app developers embed to monetize free applications. Common vectors include VPN apps, streaming applications, screensavers, and productivity tools. In many cases, users are enrolled with minimal notice. Burton described one example: A user signs up for a streaming service, and buried across multiple linked terms documents is consent for the device to join a residential proxy pool. Burton said the nominal existence of consent does not resolve the problem. The real question, she said, is whether users understood what they were agreeing to.
