For about fifteen years, a reasonable first line of defence against credential stuffing was the network. Attack traffic came from hosting providers, hosting ranges are published, and blocking or rate-limiting them was cheap and effective.
That control has quietly stopped working, and the reason is a market most defenders have never had to think about.
What a residential proxy is
A residential proxy routes someone else's traffic through a consumer internet connection. The request leaves a real home, from an address a real ISP assigned to a real customer, and arrives at its destination looking like ordinary household activity.
That is the entire product. The customer pays for the appearance of being an ordinary person at home, usually in a chosen country or city.
There are legitimate uses. Price comparison, ad verification, checking how a site renders to users in another country. There is also a large illegitimate market, and the two are served by the same infrastructure.
The scale
Bitsight published a study on 7 May 2026 covering 55 days from 19 January to 15 March 2026, examining 30 proxy services with weak know-your-customer controls.
It enumerated 53,346,368 unique proxy IP addresses globally, across 989,686,388 enumeration events. Daily peaks reached 2.3 million simultaneous exit nodes for one service and 1.85 million for another.
For comparison with how these pools are used, Google's Threat Intelligence Group observed more than 550 distinct threat groups using the exit nodes of a single provider during one seven-day period in January 2026, as reported by FIRST in April 2026.
These are not fringe numbers. A pool of tens of millions of residential addresses, rotating, is enough to give every login attempt in a large campaign its own apparently ordinary source.
Where the addresses come from
Three routes, and they differ morally far more than they differ technically.
Paid consent. Some people knowingly install proxyware in exchange for a small payment for their bandwidth. This is the clean case and it is the smallest.
Buried consent. Proxy companies pay app developers to embed their SDK in free or low-cost apps, and the licence terms include permission to route third-party traffic through the device. The user agreed, in the sense that the text was on a screen they scrolled past. FIRST's assessment is that this consent is largely nominal.
No consent at all. Bitsight describes a hidden segment built on systemic device hijacking, and found that 15.49 percent of distinct egress addresses, 8,222,677 of them, showed active malware infections, with a further 12.78 percent showing riskware activity. It names Vo1d, Badbox, RootSTV, OpenCandy, Gamarue and m0vy among the families involved. It calls those figures lower bounds, and for one provider cluster assesses that the true infection rate approaches 50 percent.
The supply chain case is worse again. FIRST describes Kimwolf spreading through unofficial Android TV boxes sold on mainstream retail platforms, arriving with Android Debug Bridge enabled and proxy SDKs preinstalled, affecting more than two million devices. Those owners were not careless. The exposure was in the box.
Why your existing controls fail
IP reputation does not fire. The address belongs to a residential ISP customer with no history of abuse, because until this week it was somebody's television.
Geolocation does not help. An attacker targeting an Albanian company can buy exit nodes in Albania. The traffic appears to come from the right country, the right city and the right ISP.
Per-account lockouts miss the pattern. The classic countermeasure assumes many attempts against one account from one source. Credential stuffing through a residential pool is few attempts per account, each from a different address, spread across thousands of accounts. Every individual attempt looks ordinary. Only the aggregate does not.
Blocking the range punishes customers. The address is shared with a real household, and increasingly with a real business: one vendor found proxy endpoints inside nearly 300 government networks, 318 utilities, 166 healthcare organisations and 141 banking and finance companies. Blocking residential ranges is not an option when your customers live in them.
What actually helps
Phishing-resistant authentication. The strongest answer, because it removes the value of a correct password rather than trying to recognise where the attempt came from. A stuffing campaign that cannot use a valid password is noise.
Checking credentials against known-compromised values. NIST SP 800-63B Revision 4, section 3.1.1.2, requires verifiers to compare a prospective password against a blocklist of known commonly used, expected or compromised values. A credential that cannot be set cannot be stuffed.
Rate limiting on the account, not the address. If the source address is effectively unique per attempt, per-IP limits measure nothing. Limits and anomaly detection have to key on the account, the device signal, and the shape of the overall attempt volume.
Watching failure patterns in aggregate. The signal that survives is distributional: a rise in failed logins across many accounts with a low per-account attempt count, from many geographically plausible addresses. Each attempt looks fine. The distribution does not.
Knowing which credentials are already exposed. The campaign is only worth running because the pairs came from somewhere. Knowing which of your accounts appear in circulating data tells you which ones the traffic is aimed at, before the attempts start.
What this does not mean
It does not mean residential proxies are malware. Most of the market is a commercial service with real customers and genuine uses, and the research describes weak know-your-customer practice rather than criminal intent on the providers' part.
It does mean that the appearance of a residential IP address now carries almost no information about whether the request is legitimate. Any control resting on that assumption needs replacing rather than tuning.
Check your own exposure
SphereTI monitors credential exposure across breach corpora, infostealer logs and credential lists, and reports which of your domains appear, where the credential came from and when it surfaced. Request a free exposure report. No password is needed.