Digital Element - Digital Element

Why Cybersecurity Companies Should Know and Care About Residential Proxy Networks

Posted on October 10, 2023August 21, 2025 by Digital Element

An emerging threat that has grown to an alarming degree over the past 18 months is residential IP proxy networks.

Numerous networks offer to make thousands, even tens of thousands of legitimate residential IPs available to parties seeking anonymity online, and at very little cost. Should this matter to you?

The short answer is yes, as players who use these proxies may be doing so in order to appear like “customers” who attempt to access your site or apps, but are bots or bad actors in disguise.

What is a Residential Proxy IP Network?

Residential Proxy IP networks are networks that use the IP addresses of consumers who sign up for any number of apps that pay them to share their internet bandwidth. Those apps become gateways for other clients of the app provider.

Put another way, residential proxy networks enable consumers with residential internet access to “sublet” their IP address to residential IP proxy network subscribers, enabling their internet traffic to appear as if it is originating from the sublet IP address.

These resi-proxy networks allow entities to purchase residential proxy IPs at scale, from any region desired, thereby posing a threat to all companies with gated web properties. What looks like a residential user in an appropriate location may actually be a bot or malicious actor hiding behind a proxy.

We have also seen evidence that bad actors leverage residential IP proxy networks to commit ad fraud, gift card schemes, access content that’s restricted by geo-location, as well as crawl government and other websites searching for PII data, such as Social Security numbers or other government ID numbers.

While residential proxy IP networks have been available for some time, what is changing is the exponential growth in both the number of networks and their scale. Certain proxy networks boast access to hundreds of thousands of residential IP addresses, which are made available to anyone willing to pay. This escalation demonstrates the need for heightened vigilance and robust security measures to combat the risks associated with these networks.

Building a Pool of Residential IP Proxies

How do residential IP proxy networks obtain those thousands of IP addresses? The networks rely on multiple strategies, such as providing an SDK to app developers who want to monetize their apps, or convincing the provider of a browser extension to include their code. They can also leverage a botnet to obtain residential IPs.

Consumers also play an important role in residential proxy IP networks, often unwittingly. The proxy networks tell consumers that by sharing their internet bandwidth, they can earn easy money. To get paid, all the consumer needs to do is install an app — Pawns.app, Honeygain, Peer2profit, PacketStream to name a few — and start collecting passive income. The amount of money they earn isn’t huge; payments range from $0.20 per GB per shared data to $75 per month. Still, it’s easy money.

The networks inform consumers that their Internet will be shared, and some, such as Honeygain, verify the use cases of its clients. Others, such as 911 S5, offer free VPN services to consumers, and harvest their IP addresses with their consent.

Consumers have no way of knowing who uses their IP address, and to what end. They are just left to trust the service. Some of the apps promise that the consumer’s data will only be sold to “credible” companies that use it for verified use cases, such as competitive analysis. But this still exposes consumers to risk. A bad actor may use their IP addresses to engage in DDoS or other nefarious attacks, resulting in a permanent ban from some sites.

This isn’t a theoretical risk. We know that residential proxies have been used in a range of crimes, including ad fraud and DDoS attacks. In the summer of 2022, the FBI seized the website Rsocks.net and shut down a botnet that engaged in malicious activity with the help of a residential proxy network.

Dangers Residential IP Proxy Networks Pose to Security Teams

Every organization has multiple layers of security, including web application firewalls (WAFs) and content delivery networks (CDNs). Unfortunately, the proliferation of residential proxy networks means these tools have a significant blind spot that must be addressed.

A WAF protects your web applications by monitoring, filtering, and blocking malicious HTTP/S traffic traveling to a web application, and prevents unauthorized data from leaving the application. It does this by adhering to a set of policies, including context around the IP address, that help determine which traffic is malicious and which is safe.

If for instance, corporate security policy mandates that all non-residential IP addresses, as well as addresses from a specific geolocation be blocked, the firewall will block all traffic that matches that criteria.

If, however, the traffic is residential and has a geo-location that is permissible, it will be deemed legitimate. Today, however, those two data points are no longer sufficient, and security teams need a lot more context around IP addresses to understand their incoming traffic.

But while WAFs and CDNs can be deployed to protect organizations against things like scraping and DDoS attacks, they can be tricked into providing access to your network if the attackers are using the services of a residential proxy network. And in case you’re wondering, these residential proxy services aren’t very expensive to use.

How Digital Element Detects Residential IP Proxies

Digital Element devotes tremendous resources to maintaining the most accurate and meaningful IP geolocation and Proxy/VPN data for our customers. Included in that is our ongoing focus on emergent technologies, such as residential proxy networks, to ensure our customers can depend on us not only for reliable geolocation data, but also insights regarding important shifts that could impact your business.

IP addresses contain a lot of contextual data that help us predict the legitimacy of a user behind a device. That contextual data includes attributes such as activity level and IP stability. We know, for instance, that proxied IP addresses are shared by clients all over the world, so they are likely to be seen in multiple locations. That’s an important insight for clients; if an IP address remains consistently associated with a specific location for an extended period, it is less likely to be a proxy.

IP address intelligence data, such as activity levels and stability, can’t decipher between legitimate and illegitimate users alone, but it can provide much needed context that organizations can use to make smart decisions to protect their advertising budgets and corporate data.

Digital Element’s Nodify Threat Intelligence solution provides critical contextual information to help identify inbound or outbound traffic tied to VPNs, proxies, or a darknet. In turn businesses are enabled with powerful insights that help them protect against nefarious actors while reducing risk and cost.

Focus on Residential IP Proxy Network Traffic

As a cybersecurity professional, you’re well aware of the cybercriminal’s astute skills and motivation to innovate new methods to find their way into corporate systems so they can steal data. As such, it’s a good time to take time out of busy schedules to do a deep dive on the cybercriminal’s newest tools.

If you’d like to learn more about Nodify and residential IP proxy traffic detection, visit https://www.digitalelement.com/nodify/ or reach out to sales@digitalenvoy.com

How To Understand The Tricky Science Behind IP Geolocation

Posted on September 6, 2023February 11, 2026 by Digital Element

IP geolocation is a subject that is often misunderstood.

Generally, people understand that it involves mapping IP addresses of internet-connected devices to a geographic location, but the nuances behind accuracy, coverage, granularity, and validation can be confusing.

In IP geolocation, validation refers to cross-checking inferred IP location against real-world observational signals to assess confidence and correct location assignments over time.

In this post, we break down the science behind IP geolocation accuracy, explain how validated observations improve confidence at the city and postal code level, and demonstrate why bi-directional accuracy matters for teams that rely on location data to perform at scale.

Why City-Level Accuracy Matters in IP Targeting

Let’s say you’re a marketer targeting Atlanta, Georgia for a programmatic or CTV campaign. Are you trying to reach only Atlanta proper, or the broader Atlanta metropolitan area, including suburbs where the majority of the population actually resides?

In most real-world use cases, success depends on the latter, because population density rarely aligns with city limits alone. As urban sprawl continues to reshape how people distribute themselves geographically, effective city-level targeting must account for surrounding suburbs and metro areas where the majority of audiences actually live.

Accurate IP geolocation must work in both directions by assigning IPs to where users actually live, not just to city centers, and by accurately reflecting real population distribution across entire metropolitan areas.

Digital Element has invested heavily in technology that supports this type of bi-directional IP accuracy, helping marketers avoid over- or under-targeting when defining geographic boundaries.

When More IP Addresses Actually Mean Less Accuracy

Returning to the Atlanta example:

Digital Element may return 5.8 million IP addresses mapped to the Atlanta market
Another provider may return 6.5 million IP addresses for the same area

At first glance, the larger dataset appears more valuable. However, raw volume alone is not an indicator of accuracy.

Atlanta proper has a population of under 500,000. If millions of IPs are assigned directly to the city center without visibility into surrounding municipalities, marketers lose confidence in where those IP addresses actually exist.

This is how IP datasets can become inflated or misleading, especially when city-level precision is claimed without validation.

In this scenario, more is less accurate.

How Digital Element Validates IP Location Using Observed GPS Truth Sets

Because IP addresses do not inherently contain location data, accuracy depends on validating IP-derived location against external signals that reflect where devices are actually observed in the real world.
Digital Element validates IP geolocation accuracy through a rigorous, multi-layered methodology built on decades of expertise. Rather than relying on any single data point, our approach integrates multiple independent validation and behavioral signals to deliver consistently reliable location intelligence. These inputs include high-quality observational datasets, such as mobile device–derived location signals, which are used to continuously verify, refine, and strengthen confidence in IP location assignments.

That GPS-based observation, alongside other validation methods, is used to:

Verify the general vicinity of the IP address
Confirm city-level and postal-level placement
Increase confidence in future lookups tied to that IP range

Digital Element performs this validation at scale.

Each month:

Over 350+ billion observations
Across more than 2 billion devices

This allows Digital Element to divide the world into highly granular, real-world geographic segments, including small cities, suburbs, and postal codes.

Digital Element is a trusted IP geolocation provider capable of validating IP location accuracy at this scale.

This view of Atlanta shows IP distribution aligning with where people and infrastructure are concentrated across the metro area, rather than clustering in the city center

Zooming out shows IP distribution matching real population density across the region, not the city center.

Challenges of IP Stability and Why Observation Recency Matters

Another common misconception is that IP addresses are static. In practice, IP addresses are frequently reassigned by ISPs, making location accuracy highly dependent on how recently an IP has been observed and evaluated.

Two providers may assign the same city to an IP address, but without recent observation, that mapping represents only relative confidence.

Digital Element refreshes IP geolocation data on an ongoing basis by:

Observing IP usage across over a billion mobile devices every 30 days
Recording the last-seen date of an IP address
Weighting more recent observations more heavily

For marketers and cybersecurity teams, when an IP was last observed is nearly as important as where it was observed.

Filtering Noise: VPNs, Proxies, and Non-Representative IPsy

Even with robust validation processes in place, IP geolocation still faces inherent challenges. These include VPN traffic, proxy services—such as residential proxies—mobile carrier infrastructure that routes traffic through shared cell towers, and Carrier-Grade Network Address Translation (CGNAT), all of which can obscure a user’s true location and complicate accurate IP assignment.

Digital Element addresses this by layering proprietary methodologies on top of validated data, filtering out IPs that are unlikely to represent meaningful end-user location.

Because Digital Element leverages the largest and most diverse datasets in the industry, it can contextualize IP behavior and remove noise that would otherwise degrade accuracy.

All of this is done within a privacy-centric framework, enabling use cases across AdTech, CTV, cybersecurity, fraud prevention, and content rights enforcement.

Frequently Asked Questions About IP Geolocation Accuracy

How should marketers evaluate city-level IP data accuracy for programmatic success?

Marketers should look beyond raw IP counts and evaluate whether IPs are:

Validated with recent observations
Distributed across real population centers
Refreshed regularly to account for IP reassignment and movement

Accuracy at scale is more important than volume, especially for CTV and programmatic campaigns.

How does IP geolocation compare to device GPS for ad delivery accuracy and scale?

GPS provides high precision but limited scale and availability, particularly on the web.
IP geolocation offers massive reach across connected devices. Digital Element combines IP scale with GPS-based validation, bridging the gap between precision and reach.

How can businesses reconcile app GPS data with web IP location?

The most effective approach is to use GPS data as a validation layer for IP-based location, ensuring consistency across app and web environments. Digital Element’s methodology is designed specifically for this reconciliation.

From Misunderstood Data to Mission-Critical Intelligence

IP geolocation is often misunderstood, but when validated correctly, it becomes a powerful tool for marketing performance, security enforcement, and global digital operations.

To learn how IP geolocation data supports multiple industries, contact Digital Element or explore our Use Cases page.

Five Ways IP Intelligence Data Helps Broadcasters

Posted on February 13, 2023August 25, 2025 by Digital Element

Broadcasters serve a vital role in communities across the country. In addition to providing news and information to communities, broadcasters are instrumental to the economy. Per the National Broadcasters Association (NAB), broadcasting accounts for more than 2.28 million jobs in the U.S., and generates $1.03 trillion annually for the nation’s economy.

Given the economic and societal importance of broadcasters, it is vital for them to have accurate data that ensures they deliver the right content, while personalizing the user experience, and protecting the digital rights of content owners. Many have long considered Digital Element as the go-to source for accurate, global IP Intelligence data to help solve some of these challenges.

Let’s look at some of the most important use cases.

#1: Licensing & Copyrights Compliance

Copyright owners never give licensors carte blanche with their intellectual properties. The more people who see or use their audio or video content, the more royalties they earn. Those agreements are negotiated by region.

Digital Element’s IP location and intelligence data helps broadcasters ensure compliance with licensing and copyright agreements. Programming content is served to audiences based on country, state/region, city, and ZIP and postal code, enabling broadcasters to ensure users in prohibited or embargoed areas are restricted from accessing their digital assets. Furthermore, the ability to identify users hiding behind proxies in order to circumvent location restrictions helps broadcasters further protect rights’ holders.

#2: Ad Serving & Content Personalization

Every marketer is keen to display the appropriate content to the right user in order to increase engagement and, ultimately, ROI.

For example, by targeting postal codes near a tentpole event, such as a music festival or a major sporting event – marketers can deliver just-in-time ads to receptive audiences (think: transportation ads to the big event, or ads that drive traffic to a local eatery franchise). Ads that reach consumers at the right place and the right time deliver higher engagement and ROI.

IP Intelligence data is inherently non-invasive, enabling marketers to tap into a wide variety of contextual data so that they can deliver relevant content to the right audiences. . Additional insights, including demographic data, allow brands to target ads relating to a population in an area or region.

#3: Enhanced User Experience

Content delivery networks (CDNs) help ensure a positive user experience by delivering content at the optimal speed based on connection, or ideal format based on viewer’s device. They also process incoming requests and deliver content to any point on the network on demand, while managing entitlements and access to video assets based on the authentication of user rights and integration into the order process.

Digital Element’s IP Intelligence data automatically detects the connection type and speed of the device, helping the CDN to ensure content is delivered at the right speed and format for the device, providing customers with high-quality viewing and sound quality with no delays or buffering interruptions.

#4: Fighting Piracy

Piracy is a scourge that threatens the broadcasting sector, putting protected content, revenue, and even jobs at risk. In its 2021 report, the Motion Picture Association (MPA) estimates that online TV and film piracy costs the U.S. economy a minimum of $29 billion in lost revenue each year, and robs the industry of hundreds and thousands of jobs.

Much of that piracy stems from consumers accessing content that’s outside of their markets — crime they can easily commit using any of the plethora of VPNs available to them. In their defense, leveraging VPN to access out-of-market content is so widespread and common that many consumers may not be aware that this behavior is illegal.

Digital Element’s director of product management discusses piracy at NAB 2022

Digital Element’s Nodify can determine whether inbound traffic is tied to a VPN, proxy, or a darknet, enabling broadcasters to block proxy and darknet traffic proactively, or prompt users for additional authentication (an important consideration as many people use VPNs for privacy or for work, and a global ban of VPN traffic will penalize many legitimate users).

Content pirates are switching tactics, switching from VPNs to residential IP proxy networks to circumvent detection. These are networks that pay consumers to share their internet across devices, and then enable other customers to “rent” that consumer traffic. However, Nodify can detect residential IP proxies, enabling broadcasters to block such traffic.

#5: Enhance Cybersecurity

Web Application Firewalls (WAFs) are important tools for broadcasters, but the rise of residential IP proxy networks has given nefarious actors a workaround. WAFs look at the IP address and geo-location of devices seeking to access a broadcaster’s web applications, and if they are residential and located within the right city or region, grant access. But without additional contextual data around network traffic, like that provided by Nodify, WAFs cannot distinguish between residential IP addresses that are real and those that are proxied.

We advise our clients that protecting their web applications requires a strong cybersecurity posture, especially considering the rise in VPN usage. Layering in threat intelligence insights, such as VPN intelligence data, can help protect your geo-filtering ecosystem; these insights allow streaming media companies to protect revenue by determining which connections pose risks, and prevent bad actors from circumvention activities by identifying anonymized connections, or connections from certain geographies.

The Cost of Cybercrime on Businesses

Posted on February 13, 2023August 25, 2025 by Digital Element

Cybercrime is on the rise, with it projected to cost businesses worldwide $10.5 trillion by 2025.

Cybercrime affects large corporations to small mom-and-pop shops. Just recently, Uber’s network was breached, and sensitive company data was leaked to the public, showing anyone is at threat. However, nearly half of all attacks are aimed at small businesses.

The results of a successful cyberattack range from monetary loss to reputational damage. Therefore, businesses worldwide need to know what they can do to keep their networks and systems safe.

We have gathered data from trusted cybersecurity reports to shed light on the cost of cybercrime on businesses and the need for reliable cybersecurity solutions.

How much do data breaches cost?

Cybercrime is a trillion-dollar industry. A single data breach on a company costs an average of $9.44 million in the U.S. Unfortunately, the initial financial loss is just the beginning; data breaches can also harm a business’s reputation and lead to a loss of current and future customers. This can be particularly hard for small and medium-sized businesses (SMBs) who may not have the necessary resources to weather the reputational fallout of a successful data breach.

How long does it take to detect a data breach?

Threat actors and their tactics get more sophisticated by the day. As such, effectively preventing every single attack on a company is near impossible. Businesses need to have protocols in place to detect and contain breaches as quickly as possible. It takes an average of 287 days to contain a breach. However, if a business can contain a data breach in 200 days or fewer, they stand to save $1.12 million on average.

IP threat intelligence is one way businesses can mitigate the damage of a successful attack. While IP data intelligence won’t stop cybercriminals from trying to attack your network, it will give you the insights needed to make informed decisions to keep data safe and mitigate damage if an attack is successful in breaching your defenses.

How prepared are companies for data breaches?

The pandemic was a blessing in disguise for threat actors. As businesses worldwide switched overnight to remote and hybrid working models, cybercriminals found themselves with a wealth of new network vulnerabilities to exploit. Unfortunately, years later, many businesses still haven’t updated their cybersecurity protocols to reflect these new working models. In fact, 32% of SMBs say they haven’t changed their cybersecurity plan since the pandemic forced them to pivot to remote and hybrid working operations.

Another issue businesses face is cost. Nearly a third of network security professionals say they don’t have the budget to effectively defend themselves against attacks. Furthermore, just half of SMBs have a cybersecurity plan in place.

Cybercriminals are constantly improving and trying new tactics to gain access to sensitive data for their own personal gain. Unfortunately, they don’t care about the devastating effects these attacks can have on businesses and their customers. We hope these alarming statistics help raise awareness about just how damaging cybercrime can be and will inspire people to take action to ensure their networks and systems are secure.

Sources:

https://www.bleepingcomputer.com/news/security/uber-suffers-new-data-breach-after-attack-on-vendor-info-leaked-online

tethttps://www.globenewswire.com/news-release/2020/11/18/2129432/0/en/Cybercrime-To-Cost-The-World-10-5-Trillion-Annually-By-2025.html

https://www.ibm.com/reports/data-breach

https://www.techrepublic.com/article/security-executives-say-unprepared-threats-lie-ahead

https://upcity.com/experts/small-business-cybersecurity-survey

VPN Detection Myth Series: Myth Five – Country-level IP Geo Provides Sufficient Protection

Posted on December 8, 2022August 22, 2025 by Digital Element

A Five-Part Blog Series to Bust the Myths Surrounding VPN Intelligence Data

Over the past few months, we’ve addressed the common questions we hear most frequently when speaking to customers about the rise of VPNs. In our discussions we hear a lot of myths about VPNs — myths that if believed can put corporation information and networks at risk.

To date, we’ve addressed the following myths:

In this final post in the series, we take on the myth that country-level IP geo data provides sufficient protection.

Myth #5: Country-level IP geo provides sufficient protection.

Throughout this blog post series, we’ve highlighted just how easy it is for VPN users to change their IP address to one that appears to originate from another location. In fact, this feature is so ubiquitous and easy that it is positioned as a selling point by VPNs that sell to consumers.

In a blog post, vpnMentor shows readers how to change their region in seconds. vpnMentor is owned by Kape Technologies PLC, which owns the following products: ExpressVPN, CyberGhost, ZenMate, Private Internet Access, and Intego (which speaks to blog number 3 in this series, Covering the Top 10 VPN Services is Sufficient).

This begs the question: how much should you trust an IP location as a proxy for a legitimate user? Let’s say a company has a policy to block all IP addresses that originate in Russia or Iran for security purposes. But does this policy actually provide any protection for the company? The answer is no, given how easy it is to change one’s IP address geographic location.

Conversely, there are good and bad VPN providers and users in every country, including the U.S. If you block users on a country level, you may inadvertently block legitimate users, some of whom may be your own employees or customers.

Let’s say an R&D company blocks IP addresses that originate in Iran. All traffic coming from that country would be deemed nefarious, right? But what if that company sent a team of scientists to present a paper to the International Conference on Science Technology and Management, which will take place in Tehran? The company’s scientists would be prevented from exchanging email with their colleagues back at home.

It’s All About Context

Here’s the reality: IP address data alone won’t protect your corporate network, but it will provide substantial context about incoming traffic. From there you can make intelligent decisions, and establish best practices, as to how to treat VPN traffic.

For instance, some VPNs offer features that are friendly to criminals, such as payment via untraceable crypto currencies, no logging which enable them to cover their tracks. If a crime against your network occurs, such VPNs will not assist you or law enforcement in tracking down the perpetrators.

Other VPNs tout the fact that users can easily change their IP address in order to bypass digital rights access restrictions, as the above example illustrates.

You may not want users of such VPNs to access your network, regardless of where they reside. In fact, you establish a set of best practices that bar users from your network based on the VPN service they use. But to implement such rules, you’ll need access to that rich contextual data in order to set access rules for your network.

The Digital Element Difference

Digital Element’s Nodify provides a rich set of IP address intelligence data so that you can understand the context of users who access your network, including:

VPN classification
Provider’s name/URL
Distinction between residential or commercial
IP addresses related to a provider

With this data in hand, you can make smart decisions about the VPN traffic that accesses your network, and set rules to enforce it. For instance, you can opt to flag all commercial VPN traffic with additional multi-factor authentication automatically.

To learn more about VPNs and how to incorporate IP geolocation and intelligence data for corporate network protection, download our white paper “The Need for Proxy/VPN Data in Today’s Heightened Cybersecurity State.”

Fight Ad Fraud with IP Intelligence Data

Posted on December 1, 2022August 21, 2025 by Digital Element

Ad fraud is a pernicious challenge, but it doesn’t need to be. With the right tools in place, invalid traffic and bots can be seriously curtailed, as the recent TAG Fraud Benchmark reveals.

There’s one tool that can help advertisers and affiliate marketers distinguish legitimate traffic from nefarious actors: IP intelligence data.

What is IP Intelligence Data?

An IP address is the unique address that identifies an Internet-connected device, be it a computer, mobile phone, or connected TV. Without it, the Internet wouldn’t be able to tell one device from another, and data would be misdirected.

All IP addresses contain a great deal of context — i.e. intelligence data — that surrounds the actual address, including:

Geolocation data (country, city, zip/postal code)
Proxy data (e.g. masked IP data that can be used by fraudsters)
Devices and Services (e.g. Web server)
Home usage vs. business usage
Company name
VPN provider & URL

IP data can help teams detect fraudulent clicks that originate from click farms or bots, thereby ensuring that budgets are spent showing ads to real humans.

Digital Element IP-Based Ad Fraud Detection Tools

IP data origin differs from provider to provider. Digital Element’s NetAcuity uses patented technology, along with over 20 proprietary methods to gain context into IP addresses. We also partner with companies that provide device-derived data from SDKs and apps, which enhances our ability to see more IP addresses, and improve our decisioning.
Nodify is a threat intelligence solution designed to help data scientists and Traffic Quality teams respond to the rise of VPN usage and the threats they pose to the digital advertising ecosystem. Nodify helps Traffic Quality teams assess VPN and Proxy traffic by delivering contextual insight around an IP address, including: VPN classification (VPN, proxy, or darknet), whether it supports fraudster-friendly features such as no logging or payment via crypto, IP addresses related to a provider, traffic type and more.

Distinguish Real Traffic from Fraud

Identify proxies used by fraudsters	Identify proxy data, which may be masked IP data that can be used by fraudsters. Distinguish between risky and benign VPNs. Identify where ads are viewed; are they in a region of the world that makes sense for the campaign? Identify when a bunch of “interesting IPs” appear but can’t connect them to anything.
Identify click farms and app-install farms	Determine fraudulent clicks and ensure budgets are spent on real impressions seen by real humans. Identify when a suspicious number of clicks come from a specific radius or timeframe.
Identify mobile proxy farms	Determine which mobile IP addresses are legit. Identify mobile IP addresses that never move.
Bot mitigation	Compare the entrance and exit nodes to identity when bots are blended in with residential traffic.
Create best practices	Use Nodify data to create inclusion and exclusion lists based on context. Distinguish between corporate VPNs and those with nefarious features.

To learn about IP address data and the role it can play in a marketing organization, access our guide, “A Guide to Understanding How IP Data Helps Marketers.”

VPN Detection Myth Series: Myth Four: VPN Threat Vectors are Far from Static

Posted on November 10, 2022August 22, 2025 by Digital Element

A Five-Part Blog Series to Bust the Myths Surrounding VPN Intelligence Data

In this five-part blog series, we tackle the questions our customers ask us, with a goal of busting the myths that are driving those questions. In our first blog post of the series, we dispelled the myth that all VPN-driven data is the same. For Part Two, we addressed the myth that VPN breadth doesn’t matter. Part Three dispelled the myth that IT teams only need to worry about detecting the VPN services included in a Top Ten list they’ve found online.

This blog post, the fourth in our series, tackles a pernicious myth that VPN threat vectors originate from common sources and remain static.

Myth #4: VPN threat vectors originate from common sources and remain static.

There are many reasons why this statement is false. Before we can even begin to identify the IP addresses that are proxies, we need to understand how the IP address space operates. There are three portions of the routable IP space that apply in this context:

ISP blocks, which are tied to ISPs that offer home and business connectivity
Mobile blocks, which are for mobile and IoT devices and provided by telecom companies
Hosting IP blocks, which is where VPN activity originated and continues to live, services all kinds of connectivity needs, such as domain or web hosting, co-location, and so on.

However, over the past 10 years, VPN providers have begun to tap into IP addresses that historically have been within Hosted IP address blocks to dynamic addresses within the ISP and Mobile blocks and are starting to leverage those as proxies.

Dynamic vs Static IPs

Given the distinction in the routable IP space, it’s no surprise that there are two broad classes of IP addresses: static and dynamic.

Static IP Address. A static IP address is one that has consistent geolocation, meaning at the time it is analyzed its geolocation is the same as previously identified. Static IP addresses are likely tied to the same end users if within an ISP block.
Dynamic IP Address. A dynamic IP address is one whose geolocation changes frequently. It’s dynamic because it can service different end users at any given moment. This is more common in Mobile and ISP blocks because end users fluctuate within a given area. These addresses are difficult to block as the end user may be different every day making blocking the IP address problematic.

Example of a Dynamic IP Address

A home user’s IP address, also known as a residential IP address, is a highly valuable IP address to a VPN provider as they are dynamic and can change everyday. A VPN service will use these addresses for their service, knowing that the IP address can change at any given moment, making it easier to circumvent restrictions that would apply to Static IP addresses.

Example of How VPN Exit Nodes Operate

Lets say a user signs up for “Big Name” VPN user and connects to a server in the U.K. They will be assigned a Static IP address of “1.2.3.4” from a hosting provider like “Digital Ocean”. That is the entrance node. The “Big Name” VPN user then wants to visit a streaming media provider. At that point the provider routes the user through an additional IP address “5.6.7.8” from an ISP like “British Telecom”. This is the exit node. And this is the IP address that looks like a residential IP address.

Furthermore, if the “Big Name” VPN user leaves the U.K. server and chooses a U.S. server from the “Big Name” VPN provider, that IP address is “9.10.11.12” and it belongs to a hosting provider, such as “Linode LLC”. This is the entrance node. If the user connects to a media streaming service, they get routed through “13.14.15.16 ” which belongs to an ISP “Comcast Cable”. This is the exit node and this is also another residential IP address.

It’s also a good example of the challenges it poses to companies that offer services to that user. Once upon a time, security teams could reasonably assume that an IP address associated with a proxy was a bad actor who should be blocked from accessing their networks or services or a bot performing a malicious action. But we see in this example that a home user can be associated with a proxy. If you’re a streaming media company, do you still block this home user, who may be a paying customer?

The Bottom Line

What does this mean for security teams? You can identify an IP address as a threat vector and block it, but that is no assurance that you’ve stopped the bad actor. That actor can simply access and use another IP address to attack your network. This is when the process of blocking certain entities can begin to look like a game of whack-a-mole.

The Digital Element Difference:

We deploy multiple strategies to help security professionals to stay on top of threat vectors.

First, we identify which IP blocks are static and which are dynamic using proprietary methodologies. Additionally, we use several different applications, each with its own methodology, to identify the IP addresses that are currently being used as proxies.

Importantly, we also see the volume and frequency of both static and dynamic IP addresses that are tied to VPNs. We can verify that dynamic IPs tied to VPNs remain predominantly in the Hosting space, even as VPN providers are actively moving into static IP space.

Given the dynamic nature of the space, we also have a very robust aging mechanism to ensure that we don’t label an IP address as a proxy longer than we should. This aging mechanism also runs 24/7.

Up Next: In our fifth and final myth of this series, we’ll talk about the pitfalls of relying only on geolocation datasets, and explain why blocking an entire geographic region isn’t always in your best interest.

Trick or Treat? How the Explosion in VPN Usage Impacts Cybersecurity

Posted on October 26, 2022August 21, 2025 by Digital Element

VPN usage exploded during the pandemic, as consumers sought ways to hide their location so that they could circumvent geographical restrictions to content. Consumers face no difficulty in finding a VPN service provider, as a plethora of free and paid residential proxy services have entered the market.

Some of these VPN services are favored by nefarious actors because the service offers features that allow them to mask their malicious activities, including scraping, scanning and network password testing. The FBI has warned that cyber criminals are exploiting home VPN usage to break into corporate systems.

As a result of this surge in the VPN market, it’s essential that security professionals gain a deep understanding of the VPN market so they can properly protect data and network assets. Knowing which VPN providers promise criminal-friendly services can help you make important decisions about the traffic that can access your network, and set policies to keep nefarious actors at bay.

Organizations Need Granular Detail Around VPN Traffic, Usage, and Intent

Earlier this year we introduced, Nodify, a threat intelligence solution that identifies whether inbound or outbound traffic is tied to a VPN, proxy, or a darknet. Nodify provides security professionals with a wealth of context around VPN providers to help you distinguish legitimate users from bad actors.

Recently we’ve made important updates to Nodify, making it the most extensive VPN detection system available. The notable updates are:

Higher Frequency: With proxy IPS and VPNs changing rapidly, Nodify data is collected on an hourly basis and provides customers with a daily update on usage.
Deeper Insights: Going beyond the generic VPN collection, Nodify provides users with critical insights into the VPN user, including services provided by the VPN provider such as “no logging,” “multihop,” and “corporate.” These fields help clients determine the good vs the bad based on their use case.
Ease of Use: Nodify has a user interface that allows clients to quickly get a complete understanding of any VPN provider through a simple web dashboard.

Treat Yourself to Our Cybersecurity Brief Today

We recently published a cybersecurity brief, “The Need for Proxy/VPN Data in Today’s Heightened Cybersecurity State” which is available for download today.

Created to help security professionals understand and respond to the surge in VPN providers and usage, this brief describes the new classes of VPNs that have emerged during the pandemic, how they exploit consumer usage, and the unique risks they pose to corporate systems.

It also provides concrete steps that security teams can take to protect their networks proactively using Nodify insights.

Download “The Need for Proxy/VPN Data in Today’s Heightened Cybersecurity State” today.

VPN Detection Myth Series: Myth Three – Covering the Top Ten VPN Services is Sufficient

Posted on October 13, 2022August 22, 2025 by Digital Element

A Five-Part Blog Series to Bust the Myths Surrounding VPN Intelligence Data

In this blog post we take on the myth that corporate security and IT teams only need to worry about the ability to detect and screen the VPN services included in a Top Ten list they’ve found online. But as you’ll see, there are flaws to this strategy.

VPN usage continues its upward trajectory. Today nearly one in every three people worldwide use one, making VPNs one of the most popular pieces of consumer software. Among the biggest reasons people use VPNs are security (43%), streaming (26%), and privacy (12%).

As any IT professional knows, the increased popularity means increased risk. VPNs have been popular tools for cybercriminals, who use them to obfuscate their original location, circumvent firewall blocks or even deep packet inspection, among other things. Once a nefarious actor has breached a network through a compromised device, such as the work PC of a remote worker, the entire network is at risk. In January of this year, police in Europe shut down VPNLab, a VPN service that cybercriminals used to distribute malware and ransomware to over 100 businesses throughout the continent. These cybercriminals were able to avoid detection tools because the VPN encrypted the traffic to the endpoint.

For publishers, people using VPNs for streaming may often be circumventing digital rights management rules put in place to prevent piracy from siphoning off revenues. In fact, piracy is expected to skyrocket as inflation and subscription fatigue collide. Content owners and operators are fighting to protect intellectual property, and are finding that fighting piracy and protecting content assets is coming down to a cybersecurity issue within their organizations.

These are not idle concerns. Naturally, corporate security teams are keen to understand the VPN market better, including which services are favored by bad actors and which are more benign. It’s a topic we’re asked about frequently, and are happy to provide our clients with the insight and tools they need to make smart decisions regarding who can access their networks, who should be flagged for additional authentication, and who should be blocked altogether.

Myth #3: Covering the top Ten VPN sites provides sufficient protection.

Fact:

Google “Top Ten VPN sites” and you’ll get a plethora of results. In fact, Google returned 53 million results in less than one second. Some of the Top Ten lists are created by well known entities, such as Forbes, Security.org and CNET, while others, like Top10VPN.com, should raise alarm bells.

But even if the source is reputable, should you trust its analysis? Take the Forbes list, which analyzed VPNs for the key features that Forbes editors value, namely cost and number of servers worldwide. The top VPN selected, Private Internet Access, was chosen because it “strikes a perfect balance of pricing, features, and usability.” To their credit, Forbes notes that some security teams are uncomfortable with its “checkered past.”

We at Digital Element are uncomfortable with the whole notion of a Top Ten VPN list, and the advice it delivers. How many VPNs were analyzed to begin with? How were they selected? In the case of Forbes, that data is absent from its report.

In its The Best VPN of 2022 list, Security.org tells readers that its security experts analyzed “dozens” of VPNs, to determine which are the best. How many dozen? And why were they selected? If a VPN wasn’t analyzed, can we assume it’s safe? How should the security team treat traffic that comes through those unanalyzed VPNs?

This is the challenge with relying on Top Ten VPN lists. On the whole they are a meaningless metric for a variety of reasons, all of which are well worth exploring. For starters, there are way more than 10 VPN services in the world today. In fact, there are way more than dozens of services. There are literally thousands of existing services, with new entrances occurring daily. In such an environment, how can anyone claim which ones ought to be included in a list of Top Ten? From our take, the most popular VPNs in the Top Ten lists are affiliate links that pay the person promoting the VPN. You can see in this list, the commissions for a sale. There is quite a lot of money in it. It’s no wonder so many people promote them.

Second, some VPNs are more concerning to specific industries than others. If you’re a company that streams copyright-protected content to subscribers, the commercial VPNs are more relevant to you than corporate VPNs. Many of the VPNs boast the ability to circumvent digital rights access parameters, which is a direct threat to your business. Consequently, your list of Top Ten VPNs will be based on a different set of criteria than a global retailer’s.

Third, the lists themselves are very suspect. While there are thousands of VPN services, many are owned by the same set of parent companies. For instance, 105 separate VPN services are owned by just 24 companies. As it happens, the VPN parent companies also own the review sites, which means they’re essentially grading their own homework. Kape Technologies owns multiple VPN services, including ExpressVPN, CyberGhost, Private Internet Access, as well as a collection of VPN review sites. There is an obvious conflict of interest between owning a service and writing its review.

This is a significant issue in the VPN space. In fact, U.S. lawmakers recently asked the Federal Trade Commission (FTC) to examine the promises VPN service providers offer consumers, as a study revealed that 75% of them make exaggerated or outright false claims about the level of protection and privacy consumers can expect.

The Digital Element Difference

Digital Element has a policy to review and classify all new VPN services as they emerge. We also monitor more than ten — or even dozens of VPN services. Currently, we monitor 361 VPNs, 56 proxies, and two darknets, which we’ve identified through mapping out the entire provider network and identifying darknet nodes.

We go beyond determining if a service is a VPN or proxy, we also go to the source of where those VPNs exist. We also provide contextual information about the VPN provider itself, a feature that is unique to Digital Element.

For instance, we provide nearly 20 fields about the provider, ranging from ID, Provider, Site URL and whether it’s a paid or free service, to location and whether it accepts crypto payment.

The rich detail we provide allows security teams to establish best practices for VPN traffic. For instance, you may opt to ban all users who use a VPN that has no paper trail, accepts payment in crypto or located in a region of the world where you have no customers, offices or employees.

Next Up: VPN threat vectors originate from common sources and remain static. Or do they? We’ll dig deeper and report on what our proprietary technologies reveal.

Kicking off Cybersecurity Awareness Month Like a Champ

Posted on October 3, 2022August 21, 2025 by Digital Element

Did you know that October is Cybersecurity Awareness month? We have answered the National Cybersecurity Alliance’s call for cybersecurity champions, because we share the Alliance’s dedication to promoting a safer, more secure and more trusted internet.

Founded in 2004, Cybersecurity Awareness Month, is the world’s foremost initiative aimed at promoting cybersecurity awareness and best practices. Led by the Cybersecurity and Infrastructure Security Agency (CISA) and the National Cybersecurity Alliance (NCA), Cybersecurity Awareness month is a collaborative effort between government and industry to raise cybersecurity awareness nationally and internationally.

A 24/7 Mission for Digital Element

It’s important to note that our dedication to cybersecurity isn’t limited to the month of October. Everyday we help security teams across the globe protect their networks against cybersecurity threats and attacks.

Moreover, we work continuously in developing new tools and relationships so that we can provide security teams with more data, insights and tools they need to keep their network and customer data secure. For instance, we recently announced enhancements to Nodify, our threat intelligence solution which provides critical context surrounding VPN traffic, enabling cybersecurity teams to understand the level of threat such traffic poses, as well as set policy around that traffic.

Education is critical to achieving our mission, and in that vein, our employees, recognized domain experts in the field, share their insights on emerging trends and security strategies by authoring white papers, presentations and articles for the benefit of the cybersecurity commission.

In the spirit of raising awareness around cybersecurity, we’ve collected some educational materials for you to access, including:

The Need for Proxy/VPN Data in Today’s Heightened Cybersecurity State. This white paper looks at the meteoric rise in VPN usage, the new classes of VPNs that have emerged and the risks they pose to corporate security. It also addresses how corporate security teams can apply rules to mitigate those risks.
How IP Data Can Help Security Professionals Protect Their Networks, an article penned by Jonathan Tomek, VP of Research and Development, Digital Element. In it Jonathan discusses how beefing up security requires a combination of forensic efforts and proactive mitigation.
How IP address data can bolster cybersecurity for federal agencies and their contractors, an article written by Justin Skogan, Vice President of Enterprise Sales for Digital Element. Justin taps into his deep expertise servicing federal agencies, and highlights areas where they can shore up their cybersecurity in the face of emerging VPN threats.
VPNs, Remote Working, and Cybercrime: How It Professionals Can Tackle 2022’s Rapidly Growing Threat, another article written by Jonathan Tomek, which goes into some of the specific risks that remote work poses to corporate security.
Three Ways IP Data Can Enhance Cybersecurity, also by Jonathan Tomek, that provides practical steps security professionals can leverage IP data to improve their cyber security.

Cybersecurity is all of our concern, and we all play a role in promoting a safer, more secure and trusted internet. Together we can achieve those goals.

About Cybersecurity Awareness Month

Cybersecurity Awareness Month is designed to engage and educate public- and private-sector partners through events and initiatives with the goal of raising awareness about cybersecurity to increase the resiliency of the nation in the event of a cyber incident. Since the Presidential proclamation establishing Cybersecurity Awareness Month in 2004, the initiative has been formally recognized by Congress, federal, state and local governments and leaders from industry and academia. This united effort is necessary to maintain a cyberspace that is safer and more resilient and remains a source of tremendous opportunity and growth for years to come. For more information, visit staysafeonline.org/cybersecurity-awareness-month/