While some companies are building proxy networks, others are profiting from detecting them. On July 15, 2026, American Spur Intelligence reported explosive growth: +210% new business and +42% annual recurring revenue (ARR) for the second quarter with 100% customer retention. Spur has one product — a detector for anonymizers: VPNs, residential proxies, and "masked" traffic. Such figures indicate a simple truth: the proxy detection industry is booming in 2026, and your IP may "burn" even before you send your first request.
What Happened: Proxy Detection Became a Separate Market
Spur is not the only player, but its report serves as a convenient thermometer for the entire segment. According to the company, 94% of organizations faced incidents involving anonymizing infrastructure — VPNs or residential proxies. At the same time, its own "IP Intelligence Study 2026" showed that only about a third of respondents truly understood the risks of abusing residential proxies before encountering an incident. Spur's CEO Kevin Hickey articulates the demand directly: "Organizations need better visibility into who is connecting to their platforms and what infrastructure is behind that activity."
Other companies are also growing: IPinfo announced in June 2026 that its database of directly observable residential proxy addresses surpassed 107 million IPs — a growth of approximately 2.3 times over the year, covering 126 proxy providers. IPQualityScore, Spur, GeoComply, and IPinfo have established themselves as a class of "IP intelligence" services that sell one service to anti-fraud teams, banks, streaming services, and government systems: to identify whether a specific IP is hiding a proxy or a botnet.
How It Works: IP Reputation and Scoring from 0 to 100
The mechanics of most detectors are similar. The input is an IP address, and the output is a fraud score from 0 to 100. The thresholds are roughly the same for IPQualityScore and Spur: 0–20 — trusted, 21–60 — suspicious, 61–100 — blocked. The site then decides what to do: allow, show a CAPTCHA, or deny access. The score is composed of the following factors:
- ASN and network type. This is the starting point. Addresses from consumer internet service providers initially receive a higher reputation than those from hosting and data center ASNs. This is why cheap data center proxies are often filtered out "at the gate" — based solely on the autonomous system number, without any behavioral analysis.
- Anonymizer Detection. Fingerprinting VPNs, proxies, and Tor: known ranges, characteristic TTL and MTU, signs of tunneling, matching entry and exit points.
- Honeypots and traps. Detectors maintain a network of decoys and "client reporting": if an IP is flagged for suspicious activity by one client, its reputation drops for all.
- Geolocation Integrity. Checking for "impossible movements" and geo desynchronization: if the IP is in Germany, but the timezone, language, and browser client hints scream another country — that's a flag.
The main technological shift of 2026, according to the vendors themselves, is the detection of residential proxies. Previously, most APIs reliably detected only data center traffic; now they increasingly recognize traffic coming through real ISP connections. Spur's Context API, for example, returns 20+ attributes for a single IP: geography, ASN, proxy/VPN attribution, device and connection type, and context of the tunnel's entry-exit points.
Why Proxies "Burn": Pool Overlap and Infected IPs
The key reason why detectors have become more effective is not magic, but the low quality of the pools themselves in the mass market. Recent measurements illustrate this clearly.
In a January (2026) analysis of over 170 million residential proxy IPs over a 90-day window (86 million IPv4 and 87 million IPv6), it was found that 46% of addresses were simultaneously present in the networks of multiple providers. For IPv4, the overlap reached nearly 70% over the long term. In simple terms, an "exclusive" pool from one seller is often the same pool that a competitor has — resold through several layers. A test of the Smartproxy.org pool showed that 773,087 of its addresses (38.21%) were also present in the IPIDEA dataset — meaning one resource largely relies on the infrastructure of another.
Even worse is the sanitary condition of these addresses. Monitoring 30 proxy services from January 19 to March 15, 2026, recorded 53 million unique exit nodes over 55 days; of these, 15% (8.2 million) were simultaneously flagged as infected with active malware, and another 13% (6.8 million) exhibited riskware activity. When a provider acquires "residential" IPs from dubious SDKs and infected devices, these same addresses are already flagged in detector databases as malicious.
A notable case is NetNut, which was dismantled by Google and the FBI on July 3, 2026: a network of 2+ million Android devices — cheap Smart TVs and streaming boxes infected through trojanized applications (Badbox 2.0) and linked to Israeli Alarum Technologies. In one week of June, 316 separate threat clusters operated through these exit nodes, conducting password-spraying attacks. Spur specifically noted that during the investigation of NetNut, among 6,038 examined applications on LG and Samsung devices, 2,058 were malicious, trading IP addresses. Each such "residential" address is someone’s hacked television, and in the IP intelligence registries, it has long been flagged.
The takeaway for the market: static blacklists are becoming outdated, but they have been replaced by infrastructure intelligence — detectors look not at the label "residential," but at the actual behavior and origin of the address.
What This Means for Those Using Proxies Legally
Scraping public data, checking advertisements, price monitoring, multi-accounting, accessing geo-content — these are legitimate tasks. But detection does not inquire about your intentions: it assesses the infrastructure. Therefore, the rules of the game are changing in 2026.
- The label "residential" guarantees nothing anymore. The origin of the pool is crucial. Addresses from infected devices and repeatedly resold ranges "burn" en masse. Clean, ethically sourced residential and mobile IPs with low overlap last longer — this is where the main quality battle is fought.
- Mobile proxies gain an advantage. Carrier CGNAT places thousands of real subscribers behind one IP — the "crowd effect" makes banning such an address costly for the site. For reputation-sensitive tasks, mobile proxies are often more resilient than a mixed residential pool. More on the choice can be found in the analysis of residential vs. mobile proxies.
- IP is only half of the fingerprint. Detectors cross-check the geo IP with the timezone, language, client hints, and browser locale. A residential IP from France with a system language of en-US and a timezone of UTC is a clear flag for Geolocation Integrity. Environmental consistency is just as important as the address itself.
- Data center does not mean "garbage," but understanding the scene is necessary. For sites without aggressive anti-fraud measures, data center proxies are cheap and fast. Against systems evaluating ASN, they lose at the gate — residential proxies are needed here .
- Check your IP in advance. Public fraud-score checks (IPQualityScore and similar) show how your address is perceived by protection systems before launching a task. If the score is already in the red zone — the issue is not with your code, but with the "burned" address.
Conclusion
Spur's 210% growth for the quarter is not just corporate news, but a signal: the defensive side of the proxy war has matured. IP intelligence has evolved into a mature industry that can distinguish clean residential traffic from resold and infected traffic. This is painful for the market, but in its own way fair: providers with transparent address origins and low pool overlaps survive, along with those who combine quality IPs with careful fingerprint hygiene and locale. In 2026, proxies ceased to be disposable "buy and forget" items; they have become a reputational asset, the cleanliness of which both sides must monitor.