Botnets powered by residential proxy networks approach 60 million victim IP addresses, Lumen Black Lotus Labs finds
Lumen's Black Lotus Labs says botnets built on residential proxy networks near 60 million victim IPs worldwide, about 1 in 4 in the US. The team tracks over 30 malicious proxy clusters, several with 100,000-plus daily victims, and says takedowns keep failing to shrink the total.
Botnets powered by residential proxy networks are now approaching 60 million victim IP addresses worldwide, according to research from Lumen's Black Lotus Labs, with roughly 1 in 4 of those compromised addresses located in the United States. These proxy botnets let cybercriminals route malicious traffic through ordinary home internet connections, making the activity far harder for defenders to distinguish from legitimate users. Black Lotus Labs tracks more than 30 distinct malicious proxy botnet clusters, several of which log more than 100,000 daily victims, and found that daily DDoS-active endpoints climbed from roughly 1 million to 8-9 million over the past year after the Kimwolf botnet fragmented into smaller networks. Law enforcement takedowns are struggling to keep pace: the IPIDEA residential proxy network, disrupted in January, recovered to near its original strength within hours and has since grown beyond its pre-disruption size. For enterprises, the trend means traffic that looks like it comes from ordinary consumer devices is increasingly likely to be part of a criminal infrastructure network, complicating fraud and intrusion detection built on IP reputation alone.