The bandwidth burn rate is painfully familiar. From the defender side, residential exits are exactly why network-type blocklists fail: the address looks like home broadband until you check proxy-class evidence.

IP99 / ThreatHunter keeps a live risk feed on those exits (proxy, VPN, dial-up pools) with scores that expire when the evidence goes stale. Handy when you’re validating whether a “clean” residential IP is actually a recycled proxy exit.