The Threat of Residential Proxies

- Residential proxies are IP addresses assigned by internet service providers (ISPs) to real homes, making traffic appear to come from a legitimate household rather than a data center or VPN exit node. Attackers acquire them through malware that infects home routers and IoT devices, or by paying users (often unknowingly) to route traffic through their connection. - This lets criminals bypass geo-restrictions, evade fraud detection systems, and avoid IP reputation blacklists — because the IP looks like a normal residential user. - The newsletter's author, Ivan Ristić, runs Feisty Duck (a security training/publishing firm) and is a well-known TLS and web security expert (creator of the SSL Labs testing tools). - Many businesses rely on IP-based signals (e.g., flagging datacenter IPs or known VPN ranges) as a cheap fraud-prevention layer. Residential proxies hollow out that defense — a login attempt from a "real home" IP is much harder to flag as malicious. - This is a growing arms race: as detection systems get smarter, proxy operators pivot to fresher, harder-to-detect residential IP pools, often harvested from infected IoT devices in the global "botnet of things."