Cybersecurity - Digital Element

Why Cybersecurity Companies Should Know and Care About Residential Proxy Networks

Posted on October 10, 2023August 21, 2025 by Digital Element

An emerging threat that has grown to an alarming degree over the past 18 months is residential IP proxy networks.

Numerous networks offer to make thousands, even tens of thousands of legitimate residential IPs available to parties seeking anonymity online, and at very little cost. Should this matter to you?

The short answer is yes, as players who use these proxies may be doing so in order to appear like “customers” who attempt to access your site or apps, but are bots or bad actors in disguise.

What is a Residential Proxy IP Network?

Residential Proxy IP networks are networks that use the IP addresses of consumers who sign up for any number of apps that pay them to share their internet bandwidth. Those apps become gateways for other clients of the app provider.

Put another way, residential proxy networks enable consumers with residential internet access to “sublet” their IP address to residential IP proxy network subscribers, enabling their internet traffic to appear as if it is originating from the sublet IP address.

These resi-proxy networks allow entities to purchase residential proxy IPs at scale, from any region desired, thereby posing a threat to all companies with gated web properties. What looks like a residential user in an appropriate location may actually be a bot or malicious actor hiding behind a proxy.

We have also seen evidence that bad actors leverage residential IP proxy networks to commit ad fraud, gift card schemes, access content that’s restricted by geo-location, as well as crawl government and other websites searching for PII data, such as Social Security numbers or other government ID numbers.

While residential proxy IP networks have been available for some time, what is changing is the exponential growth in both the number of networks and their scale. Certain proxy networks boast access to hundreds of thousands of residential IP addresses, which are made available to anyone willing to pay. This escalation demonstrates the need for heightened vigilance and robust security measures to combat the risks associated with these networks.

Building a Pool of Residential IP Proxies

How do residential IP proxy networks obtain those thousands of IP addresses? The networks rely on multiple strategies, such as providing an SDK to app developers who want to monetize their apps, or convincing the provider of a browser extension to include their code. They can also leverage a botnet to obtain residential IPs.

Consumers also play an important role in residential proxy IP networks, often unwittingly. The proxy networks tell consumers that by sharing their internet bandwidth, they can earn easy money. To get paid, all the consumer needs to do is install an app — Pawns.app, Honeygain, Peer2profit, PacketStream to name a few — and start collecting passive income. The amount of money they earn isn’t huge; payments range from $0.20 per GB per shared data to $75 per month. Still, it’s easy money.

The networks inform consumers that their Internet will be shared, and some, such as Honeygain, verify the use cases of its clients. Others, such as 911 S5, offer free VPN services to consumers, and harvest their IP addresses with their consent.

Consumers have no way of knowing who uses their IP address, and to what end. They are just left to trust the service. Some of the apps promise that the consumer’s data will only be sold to “credible” companies that use it for verified use cases, such as competitive analysis. But this still exposes consumers to risk. A bad actor may use their IP addresses to engage in DDoS or other nefarious attacks, resulting in a permanent ban from some sites.

This isn’t a theoretical risk. We know that residential proxies have been used in a range of crimes, including ad fraud and DDoS attacks. In the summer of 2022, the FBI seized the website Rsocks.net and shut down a botnet that engaged in malicious activity with the help of a residential proxy network.

Dangers Residential IP Proxy Networks Pose to Security Teams

Every organization has multiple layers of security, including web application firewalls (WAFs) and content delivery networks (CDNs). Unfortunately, the proliferation of residential proxy networks means these tools have a significant blind spot that must be addressed.

A WAF protects your web applications by monitoring, filtering, and blocking malicious HTTP/S traffic traveling to a web application, and prevents unauthorized data from leaving the application. It does this by adhering to a set of policies, including context around the IP address, that help determine which traffic is malicious and which is safe.

If for instance, corporate security policy mandates that all non-residential IP addresses, as well as addresses from a specific geolocation be blocked, the firewall will block all traffic that matches that criteria.

If, however, the traffic is residential and has a geo-location that is permissible, it will be deemed legitimate. Today, however, those two data points are no longer sufficient, and security teams need a lot more context around IP addresses to understand their incoming traffic.

But while WAFs and CDNs can be deployed to protect organizations against things like scraping and DDoS attacks, they can be tricked into providing access to your network if the attackers are using the services of a residential proxy network. And in case you’re wondering, these residential proxy services aren’t very expensive to use.

How Digital Element Detects Residential IP Proxies

Digital Element devotes tremendous resources to maintaining the most accurate and meaningful IP geolocation and Proxy/VPN data for our customers. Included in that is our ongoing focus on emergent technologies, such as residential proxy networks, to ensure our customers can depend on us not only for reliable geolocation data, but also insights regarding important shifts that could impact your business.

IP addresses contain a lot of contextual data that help us predict the legitimacy of a user behind a device. That contextual data includes attributes such as activity level and IP stability. We know, for instance, that proxied IP addresses are shared by clients all over the world, so they are likely to be seen in multiple locations. That’s an important insight for clients; if an IP address remains consistently associated with a specific location for an extended period, it is less likely to be a proxy.

IP address intelligence data, such as activity levels and stability, can’t decipher between legitimate and illegitimate users alone, but it can provide much needed context that organizations can use to make smart decisions to protect their advertising budgets and corporate data.

Digital Element’s Nodify Threat Intelligence solution provides critical contextual information to help identify inbound or outbound traffic tied to VPNs, proxies, or a darknet. In turn businesses are enabled with powerful insights that help them protect against nefarious actors while reducing risk and cost.

Focus on Residential IP Proxy Network Traffic

As a cybersecurity professional, you’re well aware of the cybercriminal’s astute skills and motivation to innovate new methods to find their way into corporate systems so they can steal data. As such, it’s a good time to take time out of busy schedules to do a deep dive on the cybercriminal’s newest tools.

If you’d like to learn more about Nodify and residential IP proxy traffic detection, visit https://www.digitalelement.com/nodify/ or reach out to sales@digitalenvoy.com

From Data to Defense: How Threat Intelligence Is Revolutionizing Cybersecurity

Posted on May 9, 2023August 21, 2025 by tenspeed

Cybersecurity threats continue to evolve, posing an ever-increasing risk to organizations. To keep pace with these threats, companies are turning to a new tool in their cybersecurity arsenal: threat intelligence.

Threat intelligence is about collecting, analyzing, and disseminating information about potential cyber threats to improve an organization’s security posture. It provides security teams with real-time and actionable insights into the threat landscape, enabling them to defend against cyberattacks proactively.

This detailed and informative guide will delve deeper into threat intelligence, exploring its different types, tools, and processes and how it’s revolutionizing cybersecurity.

A breakdown of the threat intelligence lifecycle

As organizations increasingly rely on technology and digital infrastructure, the need for comprehensive cybersecurity measures has become more pressing. Threat intelligence has emerged as a critical component of modern cybersecurity, allowing organizations to stay ahead of evolving threats and proactively guard against these potential and powerful attacks.

Below, we’ll explore the threat intelligence lifecycle from initial requirement gathering to disseminating actionable intelligence. By reading through and understanding this process, security professionals can optimize their threat intelligence efforts and bolster their organization’s security posture.

Requirements stage

The requirements stage of the threat intelligence lifecycle involves defining the objectives and priorities of the given intelligence program. This includes determining what types of intelligence are most relevant to the organization’s industry and specific threat landscape. Stakeholders must identify the areas of the organization most vulnerable to attack and prioritize the most critical assets for protection.

This crucial stage sets the foundation for the rest of the threat intelligence lifecycle — providing a clear understanding of what data is most important and how it should be collected, processed, and analyzed.

Collection stage

Once the requirements stage is complete, the collection stage begins. This involves gathering data from various sources, including internal security controls, external intelligence feeds, and open-source intelligence.

The goal of the collection stage is to collect as much relevant data as possible without overwhelming security teams with unnecessary information. The collection stage often involves using specialized tools and technologies, such as threat intelligence platforms and automated data collection systems.

Processing stage

The processing stage of the threat intelligence lifecycle involves analyzing and synthesizing the data collected in the previous step. This consists in removing irrelevant data, identifying patterns and trends, and prioritizing potential threats.

The processing stage often involves using advanced analytics tools, such as machine learning algorithms and natural language processing, to extract meaningful insights from large amounts of data. Once the data has been processed, it is ready for dissemination to stakeholders and used in decision-making processes.

Analysis stage

The collected and processed data is analyzed during the analysis stage to identify potential threats and relevant information. The goal is to use the information to produce actionable intelligence to inform security decisions.

Threat intelligence analysts will examine the information collected during the previous stages to gain insight into the attacker’s motives, capabilities, and intentions. They will also use analytical tools to evaluate the data, such as data visualization and machine learning algorithms. Once the analysis is complete, the results are passed on to the dissemination stage.

Dissemination stage

The analyzed and actionable intelligence is shared with the appropriate stakeholders in the dissemination stage. This may include security, incident response teams, executives, and other decision-makers. The intelligence can be disseminated through various channels, such as reports, briefings, dashboards, and alerts.

It’s vital to ensure that the intelligence is communicated clearly and effectively to ensure stakeholders understand the information and take appropriate action for the future of cybersecurity.

Feedback stage

The final stage in the threat intelligence lifecycle is the feedback stage. This stage is critical for improving the effectiveness of the threat intelligence program. During this stage, the effectiveness of the threat intelligence program is evaluated, and any necessary adjustments are made.

The feedback stage can include metrics such as the time it takes to detect and respond to threats, the number of false positives and negatives, and the overall effectiveness of the intelligence. The feedback received can improve the threat intelligence lifecycle’s collection, processing, analysis, and dissemination stages.

The three primary types of threat intelligence

As we’ve discussed, threat intelligence is crucial to cybersecurity operations. However, it’s essential to understand that not all threat intelligence is created equal. There are three primary types of threat intelligence: tactical, operational, and strategic. Each serves a unique purpose and can provide valuable insight into different aspects of your security posture.

Tactical intelligence

Tactical threat intelligence is essential to any organization’s threat intelligence program. This focuses on the specific techniques used by threat actors, such as the types of malware they deploy, the tactics they use to penetrate networks, and the procedures they use to evade detection. When providing a detailed understanding of the latest threats, this type of intelligence helps security teams stay ahead of cybercriminals constantly changing their tactics.

One of the primary benefits of tactical intelligence is its ability to identify and respond to threats in real time. Security teams can use this intelligence to identify and mitigate threats before they cause significant damage quickly. Tactical intelligence also provides a more actionable view of the threat landscape, enabling security teams to prioritize their responses based on the severity of the threats.

Security operations teams rely on various tools and technologies to gather tactical intelligence. One of the most common tools used is SIEMs, which provide a centralized platform for monitoring and analyzing security-related data from across the organization.

Other threat intelligence tools that aggregate data from various sources, such as threat data feeds, are also commonly used. By leveraging these tools and technologies, security teams can gather and analyze large amounts of raw data to comprehensively understand the threat landscape.

Operational intelligence

Operational threat intelligence provides a broader view of the threat landscape, focusing on the trends and patterns that enable security teams to defend against potential threats proactively.

For example, by analyzing data on phishing attacks, security teams can identify the most commonly used vectors and create targeted awareness campaigns to reduce the risk of successful attacks. Automation is critical in operational threat intelligence, enabling security teams to process and analyze large volumes of data more quickly and accurately.

Information sharing between security solutions and teams during threat hunting often nullifies cybersecurity threats. They infer the data sources they have at their disposal and will share this with intelligence teams towards a similar goal of operational excellence.

Strategic intelligence

Strategic threat intelligence provides the highest-level view of the threat landscape, focusing on long-term trends and the larger forces driving cybercrime. It can enable organizations to understand better threat actors’ motivations and capabilities and the geopolitical and economic factors that shape the threat landscape.

This intelligence type helps develop security strategies and make informed decisions about security technology and personnel investments.

Applications of threat intelligence technology

As the use of threat intelligence continues to expand in cybersecurity, its applications do as well. Threat intelligence technology is employed in various security operations, including incident response, risk management, malware analysis, brand protection, and insider threat detection. These applications help security teams gain valuable insights into external and emerging threats to protect their organizations better.

Incident response

Incident response is a critical component of any security operations center. By leveraging threat intelligence tools, security teams can quickly detect and respond to security incidents like phishing attacks or malware infections.

Threat intelligence feeds, raw data, and hashes of malicious files can be analyzed to identify the indicators of compromise (IOCs) and assess the severity of the threat. Integrations with other security tools, such as firewalls and endpoint protection systems, can enable automated responses to mitigate the attack’s impact.

Risk management threat intelligence

Technology can aid in risk management by providing organizations with insights into potential vulnerabilities and threats. By monitoring external threat data feeds and analyzing threat intel, security teams can identify potential attack vectors and prioritize their security efforts to better protect their organization’s critical assets.

Threat intelligence can provide insights into cybercrime trends, allowing organizations to adjust their security posture to stay ahead of the threat.

Malware analysis

Malware is a common threat to organizations; analyzing it is essential for mitigating its impact. With the help of threat intelligence, security analysts can detect, investigate, and respond to malware attacks more effectively.

This includes analyzing malware hashes, identifying the malware’s origin, and developing countermeasures to prevent further attacks. Threat intelligence tools can aggregate and analyze data on new malware strains, enabling security teams to identify and prioritize the most critical threats.

Brand protection

Brand protection is vital to maintaining a company’s reputation and revenue. Threat intelligence technology can help organizations protect their brand by monitoring and analyzing social media, dark web forums, and other sources for mentions of their brand.

This proactive approach can help organizations identify potential brand-related threats, such as phishing attacks, before they cause significant damage.

Insider threat detection

Insider threats are a significant concern for many organizations, as they can cause considerable damage to data, systems, and reputation. Threat intelligence tools can help security teams detect potential insider threats by monitoring employee activities, such as email usage, endpoint activity, and data access.

By reflecting on this data, security teams can identify potentially malicious activity and respond quickly to prevent data exfiltration or other harmful actions.

Harness the power of threat intelligence with Digital Element

Threat intelligence has revolutionized cybersecurity by providing valuable insights and proactive measures against multiple cyber threats. By breaking down the threat intelligence lifecycle and understanding the three primary types of threat intelligence, organizations can better protect themselves from external threats.

At Digital Element, we understand the importance of threat intelligence and provide industry-leading tools and solutions to help organizations stay ahead of emerging threats. Moreover, applying threat intelligence technology in incident response, risk management, malware analysis, brand protection, and insider threat detection can provide powerful insights and prevent cyber attacks.

Browse our website today to learn more about how we can help your organization harness the power of threat intelligence.

The Cost of Cybercrime on Businesses

Posted on February 13, 2023August 21, 2025 by Digital Element

Cybercrime is on the rise, with it projected to cost businesses worldwide $10.5 trillion by 2025.

Cybercrime affects large corporations to small mom-and-pop shops. Just recently, Uber’s network was breached, and sensitive company data was leaked to the public, showing anyone is at threat. However, nearly half of all attacks are aimed at small businesses.

The results of a successful cyberattack range from monetary loss to reputational damage. Therefore, businesses worldwide need to know what they can do to keep their networks and systems safe.

We have gathered data from trusted cybersecurity reports to shed light on the cost of cybercrime on businesses and the need for reliable cybersecurity solutions.

How much do data breaches cost?

Cybercrime is a trillion-dollar industry. A single data breach on a company costs an average of $9.44 million in the U.S. Unfortunately, the initial financial loss is just the beginning; data breaches can also harm a business’s reputation and lead to a loss of current and future customers. This can be particularly hard for small and medium-sized businesses (SMBs) who may not have the necessary resources to weather the reputational fallout of a successful data breach.

How long does it take to detect a data breach?

Threat actors and their tactics get more sophisticated by the day. As such, effectively preventing every single attack on a company is near impossible. Businesses need to have protocols in place to detect and contain breaches as quickly as possible. It takes an average of 287 days to contain a breach. However, if a business can contain a data breach in 200 days or fewer, they stand to save $1.12 million on average.

IP threat intelligence is one way businesses can mitigate the damage of a successful attack. While IP data intelligence won’t stop cybercriminals from trying to attack your network, it will give you the insights needed to make informed decisions to keep data safe and mitigate damage if an attack is successful in breaching your defenses.

How prepared are companies for data breaches?

The pandemic was a blessing in disguise for threat actors. As businesses worldwide switched overnight to remote and hybrid working models, cybercriminals found themselves with a wealth of new network vulnerabilities to exploit. Unfortunately, years later, many businesses still haven’t updated their cybersecurity protocols to reflect these new working models. In fact, 32% of SMBs say they haven’t changed their cybersecurity plan since the pandemic forced them to pivot to remote and hybrid working operations.

Another issue businesses face is cost. Nearly a third of network security professionals say they don’t have the budget to effectively defend themselves against attacks. Furthermore, just half of SMBs have a cybersecurity plan in place.

Cybercriminals are constantly improving and trying new tactics to gain access to sensitive data for their own personal gain. Unfortunately, they don’t care about the devastating effects these attacks can have on businesses and their customers. We hope these alarming statistics help raise awareness about just how damaging cybercrime can be and will inspire people to take action to ensure their networks and systems are secure.

Sources:

https://www.bleepingcomputer.com/news/security/uber-suffers-new-data-breach-after-attack-on-vendor-info-leaked-online

tethttps://www.globenewswire.com/news-release/2020/11/18/2129432/0/en/Cybercrime-To-Cost-The-World-10-5-Trillion-Annually-By-2025.html

https://www.ibm.com/reports/data-breach

Many security executives say they’re unprepared for the threats that lie ahead

Report: Average time to detect and contain a breach is 287 days

https://www.accenture.com/us-en/insights/security/invest-cyber-resilience

2022 Study: 50% of SMBs Have a Cybersecurity Plan in Place

VPN Detection Myth Series: Myth Five – Country-level IP Geo Provides Sufficient Protection

Posted on December 8, 2022August 21, 2025 by Digital Element

A Five-Part Blog Series to Bust the Myths Surrounding VPN Intelligence Data

Over the past few months, we’ve addressed the common questions we hear most frequently when speaking to customers about the rise of VPNs. In our discussions we hear a lot of myths about VPNs — myths that if believed can put corporation information and networks at risk.

To date, we’ve addressed the following myths:

In this final post in the series, we take on the myth that country-level IP geo data provides sufficient protection.

Myth #5: Country-level IP geo provides sufficient protection.

Throughout this blog post series, we’ve highlighted just how easy it is for VPN users to change their IP address to one that appears to originate from another location. In fact, this feature is so ubiquitous and easy that it is positioned as a selling point by VPNs that sell to consumers.

In a blog post, vpnMentor shows readers how to change their region in seconds. vpnMentor is owned by Kape Technologies PLC, which owns the following products: ExpressVPN, CyberGhost, ZenMate, Private Internet Access, and Intego (which speaks to blog number 3 in this series, Covering the Top 10 VPN Services is Sufficient).

This begs the question: how much should you trust an IP location as a proxy for a legitimate user? Let’s say a company has a policy to block all IP addresses that originate in Russia or Iran for security purposes. But does this policy actually provide any protection for the company? The answer is no, given how easy it is to change one’s IP address geographic location.

Conversely, there are good and bad VPN providers and users in every country, including the U.S. If you block users on a country level, you may inadvertently block legitimate users, some of whom may be your own employees or customers.

Let’s say an R&D company blocks IP addresses that originate in Iran. All traffic coming from that country would be deemed nefarious, right? But what if that company sent a team of scientists to present a paper to the International Conference on Science Technology and Management, which will take place in Tehran? The company’s scientists would be prevented from exchanging email with their colleagues back at home.

It’s All About Context

Here’s the reality: IP address data alone won’t protect your corporate network, but it will provide substantial context about incoming traffic. From there you can make intelligent decisions, and establish best practices, as to how to treat VPN traffic.

For instance, some VPNs offer features that are friendly to criminals, such as payment via untraceable crypto currencies, no logging which enable them to cover their tracks. If a crime against your network occurs, such VPNs will not assist you or law enforcement in tracking down the perpetrators.

Other VPNs tout the fact that users can easily change their IP address in order to bypass digital rights access restrictions, as the above example illustrates.

You may not want users of such VPNs to access your network, regardless of where they reside. In fact, you establish a set of best practices that bar users from your network based on the VPN service they use. But to implement such rules, you’ll need access to that rich contextual data in order to set access rules for your network.

The Digital Element Difference

Digital Element’s Nodify provides a rich set of IP address intelligence data so that you can understand the context of users who access your network, including:

VPN classification
Provider’s name/URL
Distinction between residential or commercial
IP addresses related to a provider

With this data in hand, you can make smart decisions about the VPN traffic that accesses your network, and set rules to enforce it. For instance, you can opt to flag all commercial VPN traffic with additional multi-factor authentication automatically.

To learn more about VPNs and how to incorporate IP geolocation and intelligence data for corporate network protection, download our white paper “The Need for Proxy/VPN Data in Today’s Heightened Cybersecurity State.”

VPN Detection Myth Series: Myth Four: VPN Threat Vectors are Far from Static

Posted on November 10, 2022August 21, 2025 by Digital Element

A Five-Part Blog Series to Bust the Myths Surrounding VPN Intelligence Data

In this five-part blog series, we tackle the questions our customers ask us, with a goal of busting the myths that are driving those questions. In our first blog post of the series, we dispelled the myth that all VPN-driven data is the same. For Part Two, we addressed the myth that VPN breadth doesn’t matter. Part Three dispelled the myth that IT teams only need to worry about detecting the VPN services included in a Top Ten list they’ve found online.

This blog post, the fourth in our series, tackles a pernicious myth that VPN threat vectors originate from common sources and remain static.

Myth #4: VPN threat vectors originate from common sources and remain static.

There are many reasons why this statement is false. Before we can even begin to identify the IP addresses that are proxies, we need to understand how the IP address space operates. There are three portions of the routable IP space that apply in this context:

ISP blocks, which are tied to ISPs that offer home and business connectivity
Mobile blocks, which are for mobile and IoT devices and provided by telecom companies
Hosting IP blocks, which is where VPN activity originated and continues to live, services all kinds of connectivity needs, such as domain or web hosting, co-location, and so on.

However, over the past 10 years, VPN providers have begun to tap into IP addresses that historically have been within Hosted IP address blocks to dynamic addresses within the ISP and Mobile blocks and are starting to leverage those as proxies.

Dynamic vs Static IPs

Given the distinction in the routable IP space, it’s no surprise that there are two broad classes of IP addresses: static and dynamic.

Static IP Address. A static IP address is one that has consistent geolocation, meaning at the time it is analyzed its geolocation is the same as previously identified. Static IP addresses are likely tied to the same end users if within an ISP block.
Dynamic IP Address. A dynamic IP address is one whose geolocation changes frequently. It’s dynamic because it can service different end users at any given moment. This is more common in Mobile and ISP blocks because end users fluctuate within a given area. These addresses are difficult to block as the end user may be different every day making blocking the IP address problematic.

Example of a Dynamic IP Address

A home user’s IP address, also known as a residential IP address, is a highly valuable IP address to a VPN provider as they are dynamic and can change everyday. A VPN service will use these addresses for their service, knowing that the IP address can change at any given moment, making it easier to circumvent restrictions that would apply to Static IP addresses.

Example of How VPN Exit Nodes Operate

Lets say a user signs up for “Big Name” VPN user and connects to a server in the U.K. They will be assigned a Static IP address of “1.2.3.4” from a hosting provider like “Digital Ocean”. That is the entrance node. The “Big Name” VPN user then wants to visit a streaming media provider. At that point the provider routes the user through an additional IP address “5.6.7.8” from an ISP like “British Telecom”. This is the exit node. And this is the IP address that looks like a residential IP address.

Furthermore, if the “Big Name” VPN user leaves the U.K. server and chooses a U.S. server from the “Big Name” VPN provider, that IP address is “9.10.11.12” and it belongs to a hosting provider, such as “Linode LLC”. This is the entrance node. If the user connects to a media streaming service, they get routed through “13.14.15.16 ” which belongs to an ISP “Comcast Cable”. This is the exit node and this is also another residential IP address.

It’s also a good example of the challenges it poses to companies that offer services to that user. Once upon a time, security teams could reasonably assume that an IP address associated with a proxy was a bad actor who should be blocked from accessing their networks or services or a bot performing a malicious action. But we see in this example that a home user can be associated with a proxy. If you’re a streaming media company, do you still block this home user, who may be a paying customer?

The Bottom Line

What does this mean for security teams? You can identify an IP address as a threat vector and block it, but that is no assurance that you’ve stopped the bad actor. That actor can simply access and use another IP address to attack your network. This is when the process of blocking certain entities can begin to look like a game of whack-a-mole.

The Digital Element Difference:

We deploy multiple strategies to help security professionals to stay on top of threat vectors.

First, we identify which IP blocks are static and which are dynamic using proprietary methodologies. Additionally, we use several different applications, each with its own methodology, to identify the IP addresses that are currently being used as proxies.

Importantly, we also see the volume and frequency of both static and dynamic IP addresses that are tied to VPNs. We can verify that dynamic IPs tied to VPNs remain predominantly in the Hosting space, even as VPN providers are actively moving into static IP space.

Given the dynamic nature of the space, we also have a very robust aging mechanism to ensure that we don’t label an IP address as a proxy longer than we should. This aging mechanism also runs 24/7.

Up Next: In our fifth and final myth of this series, we’ll talk about the pitfalls of relying only on geolocation datasets, and explain why blocking an entire geographic region isn’t always in your best interest.

Trick or Treat? How the Explosion in VPN Usage Impacts Cybersecurity

Posted on October 26, 2022August 21, 2025 by Digital Element

VPN usage exploded during the pandemic, as consumers sought ways to hide their location so that they could circumvent geographical restrictions to content. Consumers face no difficulty in finding a VPN service provider, as a plethora of free and paid residential proxy services have entered the market.

Some of these VPN services are favored by nefarious actors because the service offers features that allow them to mask their malicious activities, including scraping, scanning and network password testing. The FBI has warned that cyber criminals are exploiting home VPN usage to break into corporate systems.

As a result of this surge in the VPN market, it’s essential that security professionals gain a deep understanding of the VPN market so they can properly protect data and network assets. Knowing which VPN providers promise criminal-friendly services can help you make important decisions about the traffic that can access your network, and set policies to keep nefarious actors at bay.

Organizations Need Granular Detail Around VPN Traffic, Usage, and Intent

Earlier this year we introduced, Nodify, a threat intelligence solution that identifies whether inbound or outbound traffic is tied to a VPN, proxy, or a darknet. Nodify provides security professionals with a wealth of context around VPN providers to help you distinguish legitimate users from bad actors.

Recently we’ve made important updates to Nodify, making it the most extensive VPN detection system available. The notable updates are:

Higher Frequency: With proxy IPS and VPNs changing rapidly, Nodify data is collected on an hourly basis and provides customers with a daily update on usage.
Deeper Insights: Going beyond the generic VPN collection, Nodify provides users with critical insights into the VPN user, including services provided by the VPN provider such as “no logging,” “multihop,” and “corporate.” These fields help clients determine the good vs the bad based on their use case.
Ease of Use: Nodify has a user interface that allows clients to quickly get a complete understanding of any VPN provider through a simple web dashboard.

Treat Yourself to Our Cybersecurity Brief Today

We recently published a cybersecurity brief, “The Need for Proxy/VPN Data in Today’s Heightened Cybersecurity State” which is available for download today.

Created to help security professionals understand and respond to the surge in VPN providers and usage, this brief describes the new classes of VPNs that have emerged during the pandemic, how they exploit consumer usage, and the unique risks they pose to corporate systems.

It also provides concrete steps that security teams can take to protect their networks proactively using Nodify insights.

Download “The Need for Proxy/VPN Data in Today’s Heightened Cybersecurity State” today.

VPN Detection Myth Series: Myth Three – Covering the Top Ten VPN Services is Sufficient

Posted on October 13, 2022August 21, 2025 by Digital Element

A Five-Part Blog Series to Bust the Myths Surrounding VPN Intelligence Data

In this blog post we take on the myth that corporate security and IT teams only need to worry about the ability to detect and screen the VPN services included in a Top Ten list they’ve found online. But as you’ll see, there are flaws to this strategy.

VPN usage continues its upward trajectory. Today nearly one in every three people worldwide use one, making VPNs one of the most popular pieces of consumer software. Among the biggest reasons people use VPNs are security (43%), streaming (26%), and privacy (12%).

As any IT professional knows, the increased popularity means increased risk. VPNs have been popular tools for cybercriminals, who use them to obfuscate their original location, circumvent firewall blocks or even deep packet inspection, among other things. Once a nefarious actor has breached a network through a compromised device, such as the work PC of a remote worker, the entire network is at risk. In January of this year, police in Europe shut down VPNLab, a VPN service that cybercriminals used to distribute malware and ransomware to over 100 businesses throughout the continent. These cybercriminals were able to avoid detection tools because the VPN encrypted the traffic to the endpoint.

For publishers, people using VPNs for streaming may often be circumventing digital rights management rules put in place to prevent piracy from siphoning off revenues. In fact, piracy is expected to skyrocket as inflation and subscription fatigue collide. Content owners and operators are fighting to protect intellectual property, and are finding that fighting piracy and protecting content assets is coming down to a cybersecurity issue within their organizations.

These are not idle concerns. Naturally, corporate security teams are keen to understand the VPN market better, including which services are favored by bad actors and which are more benign. It’s a topic we’re asked about frequently, and are happy to provide our clients with the insight and tools they need to make smart decisions regarding who can access their networks, who should be flagged for additional authentication, and who should be blocked altogether.

Myth #3: Covering the top Ten VPN sites provides sufficient protection.

Fact:

Google “Top Ten VPN sites” and you’ll get a plethora of results. In fact, Google returned 53 million results in less than one second. Some of the Top Ten lists are created by well known entities, such as Forbes, Security.org and CNET, while others, like Top10VPN.com, should raise alarm bells.

But even if the source is reputable, should you trust its analysis? Take the Forbes list, which analyzed VPNs for the key features that Forbes editors value, namely cost and number of servers worldwide. The top VPN selected, Private Internet Access, was chosen because it “strikes a perfect balance of pricing, features, and usability.” To their credit, Forbes notes that some security teams are uncomfortable with its “checkered past.”

We at Digital Element are uncomfortable with the whole notion of a Top Ten VPN list, and the advice it delivers. How many VPNs were analyzed to begin with? How were they selected? In the case of Forbes, that data is absent from its report.

In its The Best VPN of 2022 list, Security.org tells readers that its security experts analyzed “dozens” of VPNs, to determine which are the best. How many dozen? And why were they selected? If a VPN wasn’t analyzed, can we assume it’s safe? How should the security team treat traffic that comes through those unanalyzed VPNs?

This is the challenge with relying on Top Ten VPN lists. On the whole they are a meaningless metric for a variety of reasons, all of which are well worth exploring. For starters, there are way more than 10 VPN services in the world today. In fact, there are way more than dozens of services. There are literally thousands of existing services, with new entrances occurring daily. In such an environment, how can anyone claim which ones ought to be included in a list of Top Ten? From our take, the most popular VPNs in the Top Ten lists are affiliate links that pay the person promoting the VPN. You can see in this list, the commissions for a sale. There is quite a lot of money in it. It’s no wonder so many people promote them.

Second, some VPNs are more concerning to specific industries than others. If you’re a company that streams copyright-protected content to subscribers, the commercial VPNs are more relevant to you than corporate VPNs. Many of the VPNs boast the ability to circumvent digital rights access parameters, which is a direct threat to your business. Consequently, your list of Top Ten VPNs will be based on a different set of criteria than a global retailer’s.

Third, the lists themselves are very suspect. While there are thousands of VPN services, many are owned by the same set of parent companies. For instance, 105 separate VPN services are owned by just 24 companies. As it happens, the VPN parent companies also own the review sites, which means they’re essentially grading their own homework. Kape Technologies owns multiple VPN services, including ExpressVPN, CyberGhost, Private Internet Access, as well as a collection of VPN review sites. There is an obvious conflict of interest between owning a service and writing its review.

This is a significant issue in the VPN space. In fact, U.S. lawmakers recently asked the Federal Trade Commission (FTC) to examine the promises VPN service providers offer consumers, as a study revealed that 75% of them make exaggerated or outright false claims about the level of protection and privacy consumers can expect.

The Digital Element Difference

Digital Element has a policy to review and classify all new VPN services as they emerge. We also monitor more than ten — or even dozens of VPN services. Currently, we monitor 361 VPNs, 56 proxies, and two darknets, which we’ve identified through mapping out the entire provider network and identifying darknet nodes.

We go beyond determining if a service is a VPN or proxy, we also go to the source of where those VPNs exist. We also provide contextual information about the VPN provider itself, a feature that is unique to Digital Element.

For instance, we provide nearly 20 fields about the provider, ranging from ID, Provider, Site URL and whether it’s a paid or free service, to location and whether it accepts crypto payment.

The rich detail we provide allows security teams to establish best practices for VPN traffic. For instance, you may opt to ban all users who use a VPN that has no paper trail, accepts payment in crypto or located in a region of the world where you have no customers, offices or employees.

Next Up: VPN threat vectors originate from common sources and remain static. Or do they? We’ll dig deeper and report on what our proprietary technologies reveal.

Kicking off Cybersecurity Awareness Month Like a Champ

Posted on October 3, 2022August 21, 2025 by Digital Element

Did you know that October is Cybersecurity Awareness month? We have answered the National Cybersecurity Alliance’s call for cybersecurity champions, because we share the Alliance’s dedication to promoting a safer, more secure and more trusted internet.

Founded in 2004, Cybersecurity Awareness Month, is the world’s foremost initiative aimed at promoting cybersecurity awareness and best practices. Led by the Cybersecurity and Infrastructure Security Agency (CISA) and the National Cybersecurity Alliance (NCA), Cybersecurity Awareness month is a collaborative effort between government and industry to raise cybersecurity awareness nationally and internationally.

A 24/7 Mission for Digital Element

It’s important to note that our dedication to cybersecurity isn’t limited to the month of October. Everyday we help security teams across the globe protect their networks against cybersecurity threats and attacks.

Moreover, we work continuously in developing new tools and relationships so that we can provide security teams with more data, insights and tools they need to keep their network and customer data secure. For instance, we recently announced enhancements to Nodify, our threat intelligence solution which provides critical context surrounding VPN traffic, enabling cybersecurity teams to understand the level of threat such traffic poses, as well as set policy around that traffic.

Education is critical to achieving our mission, and in that vein, our employees, recognized domain experts in the field, share their insights on emerging trends and security strategies by authoring white papers, presentations and articles for the benefit of the cybersecurity commission.

In the spirit of raising awareness around cybersecurity, we’ve collected some educational materials for you to access, including:

The Need for Proxy/VPN Data in Today’s Heightened Cybersecurity State. This white paper looks at the meteoric rise in VPN usage, the new classes of VPNs that have emerged and the risks they pose to corporate security. It also addresses how corporate security teams can apply rules to mitigate those risks.
How IP Data Can Help Security Professionals Protect Their Networks, an article penned by Jonathan Tomek, VP of Research and Development, Digital Element. In it Jonathan discusses how beefing up security requires a combination of forensic efforts and proactive mitigation.
How IP address data can bolster cybersecurity for federal agencies and their contractors, an article written by Justin Skogan, Vice President of Enterprise Sales for Digital Element. Justin taps into his deep expertise servicing federal agencies, and highlights areas where they can shore up their cybersecurity in the face of emerging VPN threats.
VPNs, Remote Working, and Cybercrime: How It Professionals Can Tackle 2022’s Rapidly Growing Threat, another article written by Jonathan Tomek, which goes into some of the specific risks that remote work poses to corporate security.
Three Ways IP Data Can Enhance Cybersecurity, also by Jonathan Tomek, that provides practical steps security professionals can leverage IP data to improve their cyber security.

Cybersecurity is all of our concern, and we all play a role in promoting a safer, more secure and trusted internet. Together we can achieve those goals.

About Cybersecurity Awareness Month

Cybersecurity Awareness Month is designed to engage and educate public- and private-sector partners through events and initiatives with the goal of raising awareness about cybersecurity to increase the resiliency of the nation in the event of a cyber incident. Since the Presidential proclamation establishing Cybersecurity Awareness Month in 2004, the initiative has been formally recognized by Congress, federal, state and local governments and leaders from industry and academia. This united effort is necessary to maintain a cyberspace that is safer and more resilient and remains a source of tremendous opportunity and growth for years to come. For more information, visit staysafeonline.org/cybersecurity-awareness-month/

VPN Detection Myth Series: Myth Two – VPN Breadth Doesn’t Matter

Posted on September 26, 2022August 21, 2025 by Digital Element

A Five-Part Blog Series to Bust the Myths Surrounding VPN Intelligence Data

No trend deserves the corporate security team’s attention more than the explosion of VPN usage, as well as the influx of VPN providers to the market.

The numbers speak for themselves:

By 2027, the total VPN market may reach $92.6 billion.
Consumers will contribute to the growth; per IDC, the market for consumer VPNs will double in size, reaching $834 million by 2024.

Countless people will attempt to access corporate systems and websites via a VPN service, forcing security teams to make decisions as to which are legitimate, which are suspect, and which are likely to have nefarious intentions.

In our first blog post of the series, we dispelled the myth that all VPN-driven data is the same. In this post we take on the myth that VPN breadth doesn’t matter.

Myth #2: VPN breadth doesn’t matter. Once you know the entrance IP addresses you have the VPN covered.

Fact: Google “VPN providers” and you’ll see plenty of Top 10 or Top 25 lists, few of which contain the exact same providers. How many VPN services are there exactly? It’s a difficult question to answer, but it’s probably somewhere in the thousands. With that many providers, breadth absolutely matters!

Let’s start with some basics. Not all VPN services are the same. Broadly speaking, there are four main types:

1. Commercial VPN aka Personal VPN

This is a service that’s geared to individual or personal use rather than business use. Personal VPNs are used to protect a home or office computers and devices from external attacks. They’re also used to circumvent geography-based restrictions to content. These can be used on mobile devices, laptops, and home routers.

2. Corporate VPN aka Remote Access

This is a service that allows employees who work remotely to access and use their employers’ corporate data, systems and applications. All traffic between the user and the corporate network is encrypted.

3. Private Relay

This is designed to enable privacy for an individual without allowing them to circumvent geography-based restrictions. The goal of these types of VPNs is to encrypt network traffic to prevent data snooping.

4. Site-to-Site VPN

This is a connection between two or more networks, such as a network within a corporate HQ and one in a local branch office.

Complicating matters further, VPN infrastructure can be quite broad with numerous entry and exit points that change frequently. For instance, a commercial VPN service allows a user to enter the VPN via a US-based IP address and exit it via an IP address that’s located in another country. This allows the user to bypass any geo-restriction policies — an action that you will miss if you have just the US-based point of entry IP address.

Keep in mind that there are many free and low-cost commercial VPN services on the market that offer simple interfaces that allow users to change the location of their IP addresses quickly and easily. In fact, many services offer this functionality as a key selling point.

This means that an employee can also use a personal VPN service from within your corporate campus to circumvent your internal company policies, such as one that bans streaming videos while in the office. Worse, a VPN can be used to exfiltrate internal data outside of the network — an event that security tools can’t always detect.

The bottom line: One IP data point — either the entrance or exit point — is like one hand clapping.

The Digital Element Difference: We are an IP address intelligence data provider that tracks both entrance and exit points of your traffic, which means we are the only company that can eliminate these blindspots for you.

Our breadth of data provides the context you need to protect your corporate network by establishing and implementing best practices about VPN traffic.

Next up: The common myth that covering the top 10 VPN sites provides sufficient protection. We look forward to giving you the whole story on this.

VPN Detection Myth Series: Myth One – All VPN-driven Data is the Same.

Posted on September 14, 2022August 21, 2025 by Digital Element

A Five-Part Blog Series to Bust the Myths Surrounding VPN Intelligence Data

It’s no secret that VPN usage is exploding. Driven by the pandemic and lockdown orders, consumers everywhere signed up for a VPN service in order to access content that was otherwise off limits to them. Others were keen to secure their privacy.

Today, some 1.6 billion people — about 31% of the world’s Internet users — rely on a VPN to surf the web and access apps anonymously.

That enormous pool of users is an irresistible draw for entrepreneurs, investors, consumers and nefarious actors who see an opportunity to cash in on the trend. There are thousands of VPN services (though most are owned by the same subset of parent companies). Obviously, a great deal of VPN usage is benign, but not all of it. For instance, the credentials of 21 million VPN users were stolen from just three VPN apps, SuperVPN, GeckoVPN and ChatVPN, and are now up for sale on the dark web.

Residential users aren’t the only victims, as the FBI has warned that cyber criminals are exploiting home VPN usage to break into corporate systems. Meanwhile, streaming companies and compliance teams have seen VPN users circumvent their geographical rights management and digital rights restrictions.

The crimes are both serious and costly given that many VPN providers are happy to turn a blind eye to the activities of their users, providing them with a gateway for a range of malicious activities, including scraping, scanning and testing passwords in order to access your network.

Today, corporate security and compliance teams must navigate treacherous waters. With remote and hybrid work models a permanent fixture, employees sign into their workspaces via the corporate VPN by day, and their personal VPN by night, exposing the company’s systems to unprecedented risk.

Security and compliance teams feel a tremendous urgency to get a handle on the VPN market so they can make smart decisions about which VPN traffic to allow, which to investigate, and which to ban altogether. To make those distinctions, however, they need context and insight. VPN intelligence data is essential. But not all VPN data is equally valuable; critical differences exist, and those differences can spell the difference between a hack that is cauterized quickly, and one that makes national headlines.

There are many myths about VPN data. In this five-part blog series, we examine those myths one at a time. First up: the myth that all VPN-driven data is the same.

Fact: No, Not All VPN-Driven Data is the Same

Too often we hear that “all VPN-driven data is the same.” The differences begin with where the data originates — the VPN provider itself — and its intentions when offering a service to the market.

For instance, some VPN services are built for securing an organization (e.g. Zero-Trust Gateways), while some are privacy focused (e.g. Google VPN). Some allow the user to determine his or her exit destination to circumvent restrictions (e.g. NordVPN) in order to bypass digital rights restrictions. This means that each and every traffic source must be evaluated in its own right to determine which is safe, potentially suspect, or outright nefarious.

Additionally, the breadth of data can vary from provider to provider. A lot of VPN intelligence data providers get their data from a limited scope of sources, such as gambling apps. This is a huge problem because it misses vast swaths of VPN usage. For instance, schools and universities require students to use their VPN to register for classes or pay their tuition. None of this traffic will be covered by a service that relies on limited sources for their main source of data.

Millions of people who are not gamblers sign up for a VPN service in order to circumvent digital access rights so that they can stream content outside of their geo-location (e.g. stream The Office via UK Netflix rather than pay for a Peacock TV subscription).

And there are corporate VPNs which convolutes things. Let’s say an employee is at her desk researching products for her job via your corporate VPN. When she visits a website outside your network, she will appear to that website as an unknown actor hiding behind a VPN. Is she a legitimate customer or a competitor seeking to steal company secrets? To make that determination, the security team for that website will need more context around your VPN itself, such as the company name, provider URL, and so on.

Here’s another example for why context is critical: you may consider all VPN traffic originating in Russia as suspect and block it automatically. But what if you have employees (or students, if you’re a university) traveling there for work or a study abroad program? You may block legitimate people from accessing your network based on broad brushstrokes.

The Bottom Line

There is no one “best source” of data to protect business interests. The datasets that are right for your industry depends on your sector, geo-location, users, employees, and a host of other factors. There is no one-size-fits-all.

The Digital Element Difference: We don’t rely on a single source for our IP address intelligence data. Rather, we tap into multiple sources to ensure we have no gaps. And importantly, we distinguish between different types of VPN traffic and provide context around each VPN to help security teams understand the user behind the traffic.

Our breadth of data provides the context you need to investigate and contain breaches, enforce digital rights management, as well as establish and implement best practices about VPN traffic.

Next up: The common myth that VPN breadth doesn’t matter. Once you have one IP, you have the VPN covered. We look forward to getting the facts straight on this one.