October 2026 Risky IP Insights: 50%+ Vanish Within a Week

Key Findings (September 27 – October 25, 2026 Observation Window)

Across the 29-day observation window, Threat Hunter tracked approximately 49 million unique IPv4 addresses exhibiting proxy relay or business fraud activity (1.3% of all globally routable IPv4 space, with 77% on residential broadband, 10% on mobile networks, and only 6% in datacenters). Focusing on the four operational blind spots where defense rules most often fail, our telemetry reveals:

• ~5-day half-life makes 30-day blocklists nearly half dead weight: Among newly observed risky IPs, 32% appear for only a single day, and roughly half stop appearing within 5 days (42.3% remain active on Day 7). Because ISPs dynamically reassign home broadband addresses to ordinary households, keeping residential IP bans for 30 or 90 days misses the attacker who already rotated out while blocking the next legitimate customer assigned that address.
• A 1-day refresh lag loses ~5% coverage; a 1-week lag misses one-third: A 7-day rolling blocklist updated the same day covers 84.2% of active daily risky IPs. Delaying updates by 1 day drops coverage to 79.5%, a 7-day delay drops it to 67.1%, and a 14-day delay leaves 61.3%. Even with zero-lag daily updates, 15.8% of active risky IPs each day have zero prior appearances in the preceding 7 days and require live request-time scoring.
• Two distinct adversary populations: 14% persistent IPs drive 63% of volume vs. 32% one-day flash IPs: Risky IPs are sharply bifurcated. The 14% of IPs active for 15 or more days generate 63% of all risky activity (24% sit in datacenters, and 95% remain active in the final week), with the top 10% most active IPs alone driving 62% of volume. Conversely, the 32% single-day flash IPs generate just 3% of activity (81% outside China). Static blocklists work well against the persistent 14% but fail against the one-day 32%.
• 89% hijacked shared residential proxies in China vs. a 29% October surge outside China: Within China (25.1% of global risky IPs), 89% are hijacked shared proxies (93% on residential broadband across China Telecom, China Mobile, and China Unicom), where criminal proxy traffic shares the same home router as legitimate consumers—making step-up verification far safer than hard IP blocks. Outside China (75% of risky IPs across 116 countries and regions), risky IPs are predominantly dedicated proxy pools, and weekly active volume climbed 29% from late September to 20.66 million in late October.

1. 49 Million Risky IPv4 Addresses: Network Substrate and Geographic Split

Between September 27 and October 25, 2026 (a 29-day observation window), Threat Hunter recorded approximately 49 million unique IPv4 addresses involved in proxy relay or fraudulent business requests—representing 1.3% of all globally routable IPv4 space, or roughly 1 in every 75 public IPv4 addresses worldwide.

By risk category, 80% operated as proxy exit nodes and 22% were hijacked shared proxies (consumer home routers, optical modems, or smart devices silently infected with proxy malware and resold by proxy networks while the household continues normal browsing; a small fraction of IPs carry multiple labels). By network type, 77% resided on residential broadband, 10% on mobile cellular networks, only 6% in datacenters (IDC), 5% on enterprise dedicated lines, and 0.3% on campus networks.

Geographically, 75% of risky IPs were located outside China across 116 countries and regions, led by Brazil (13.9%), India (11.5%), and the United States (7.4%), with Latin America, Europe, and South Asia accounting for the largest regional shares. The remaining 25.1% were located in China.

Enlarge

Analyst Assessment: That attackers have moved from datacenters to residential networks is no longer news. The real operational challenge when 87% of risky IPs sit on residential broadband and mobile networks is solving three concrete failure modes: collateral damage from stale residential IP bans after ISP address reassignment, coverage decay from delayed feed updates, and false rejections when legitimate consumers sit behind hijacked shared home routers.

2. Fast Churn: Over Half of Newly Observed Risky IPs Vanish Within a Week

Tracking daily cohorts of newly observed risky IPs (October 4–11) across the following 14 days shows steep decay. Fully 32% appear on only a single day and never return; only 43.3% reappear one day after first observation, retention drops to 50.0% around Day 5, reaches 42.3% by Day 7, and settles at 39.7% by Day 14. Across the full 29-day dataset, nearly half (46.4%) of all risky IPs observed during the month were already inactive during the final week.

Enlarge

Analyst Assessment: A newly observed residential risky IP has an effective block window of roughly 7 to 14 days. Because residential ISPs reassign IPv4 addresses across households via PPPoE reconnects and DHCP lease rotation, keeping a static 30-day or 90-day blocklist means nearly half the entries are dead weight after a single week—failing to stop attackers who have already rotated to fresh IPs while blocking legitimate users who inherit the recycled addresses.

3. Feed Staleness: Every Day of Update Delay Costs Coverage

Evaluating a 7-day rolling blocklist against each day's active risky IPs (October 4–25) quantifies the exact cost of update latency: a feed refreshed the same day covers 84.2% of active daily risky IPs. A 1-day lag drops coverage by nearly 5 percentage points to 79.5%; a 3-day lag drops it to 74.4%; a 7-day lag (weekly refresh) drops coverage to 67.1%—missing roughly one-third of active threats—and a 14-day lag leaves only 61.3%.

Enlarge

Analyst Assessment: Even a zero-latency daily feed hits a hard ceiling at 84.2%, because 15.8% of active risky IPs on any given day are making their first appearance in at least 7 days. Daily (or streaming) list updates are essential to prevent the 84.2% → 67.1% decay, while request-time risk scoring is required to catch the 15.8% daily first-time cohort.

4. Bifurcated Adversaries: 14% Persistent IPs Drive 63% of Risky Activity

Segmenting all 49 million risky IPs by cumulative active days across the 29-day window reveals two structurally opposite populations:

1. Persistent Tier (active 15–29 days): Represents just 14% of unique risky IPs but generates 63% of all risky activity. Ranked by per-IP volume, the top 10% most active risky IPs account for 62% of total risky traffic.
2. Rotating Mid-Tier (active 2–14 days): Represents 54% of unique IPs and 34% of risky activity.
3. Single-Day Flash Tier (active 1 day only): Represents 32% of unique IPs but contributes only 3% of risky activity; 81% are located outside China, overwhelmingly on residential broadband and mobile networks.

Enlarge

Analyst Assessment: Blocklists and real-time scoring are complements, not substitutes. The persistent 14% (where datacenter share jumps to 24% and 95% remain active in the final week) should be placed on high-confidence blocklists for immediate rejection, eliminating nearly two-thirds of risky volume at minimal cost. Conversely, the 32% single-day flash crowd rotates out before static lists can react and must be handled by real-time behavioral and network scoring.

5. Inside China: 89% of Risky IPs Are Hijacked Shared Residential Proxies

Risky IPs located in China account for 25.1% of the global total (~12.3 million IPs), but their underlying infrastructure differs fundamentally from the rest of the world. Fully 89% of risky IPs in China are hijacked shared proxies—ordinary household routers, broadband modems, or IoT devices compromised by proxy malware and silently monetized by proxy platforms while the family uses the connection as normal:

• 93% sit on home broadband: Hijacked shared proxies in China reside almost entirely on consumer residential lines.
• Evenly distributed across major carriers: China Telecom (38%), China Mobile (28%), and China Unicom (27%) mirror general consumer broadband market share, preventing any carrier-level subnet block.
• Faster turnover than dedicated proxies: 45% of hijacked shared proxies remained active in the final week of the window, compared with 57% for other risky IPs.
• Remaining 11% are dedicated/self-built proxies: Primarily hosted on cloud datacenter instances and enterprise lines. Outside China (75% of global risky IPs), risky IPs consist almost entirely of dedicated proxy pools, with hijacked shared proxies accounting for less than 0.1% in Threat Hunter's telemetry.

Analyst Assessment: When a service operating in China encounters a risky IP, nearly nine times out of ten that address is simultaneously serving a legitimate household. Hard-blocking the IP blocks real customers and triggers support escalations; teams should trigger step-up verification (SMS OTP, biometric, or CAPTCHA challenge) combined with device fingerprint and account telemetry rather than flat IP rejection.

6. Outside China: Weekly Active Risky IPs Rose 29% in Late October

Tracked by calendar week (Monday through Sunday), risky IP volume outside China expanded steadily throughout October: weekly active risky IPs outside China climbed from 15.99 million in Week 1 (Sept 28 – Oct 4) to 20.66 million in Week 4 (Oct 19 – Oct 25), a 29.2% (~30%) increase. Over the same period, weekly active risky IPs in China fluctuated within a narrow band between 7.85 million and 9.26 million, ending Week 4 at 8.60 million (+9.6% vs. Week 1).

Enlarge

Analyst Assessment: International digital businesses face an expanding pool of residential and mobile proxy exits concentrated in Latin America (Brazil), South Asia (India), North America (United States), Europe, and the Middle East. Registration, login, promotion claim, and checkout flows serving these regions should apply real-time IP risk evaluation to residential and mobile traffic.

7. Defensive Recommendations: Align IP Controls with Churn Reality

Based on the retention decay, feed latency, and proxy infrastructure findings across 49 million risky IPs in October 2026, security and fraud teams should implement four concrete policy changes:

Threat Hunter continuously tracks the emergence, rotation, and decay of risky IPs worldwide, delivering real-time IP Risk Intelligence so security teams can act on an IP address's live risk state and proxy role rather than stale blocklists.