Network Research & Threat Intelligence
Independent studies on internet protocol allocation, global DNS security, routing peering efficiencies, and dynamic threat telemetry.
Active Research Publications
Internet Security & Threat Intelligence Report 2026
This report synthesizes public threat-intelligence and abuse-registry data on scanning and credential-stuffing activity through mid-2026. The primary cybersecurity threat pattern documented across those sources is the systemic shift of automated scanning networks away from public cloud infrastructure (such as standard VPS server subnets) toward consumer <a href="/vpn" class="text-blue-500 hover:text-blue-600 dark:text-blue-400 dark:hover:text-blue-300 underline font-medium">SOCKS5 residential proxy networks</a> and mobile Carrier-Grade NAT (CGNAT) pools. In past years, security firewalls could block malicious scanning activity by registering known hosting ASN blocks. Today, telemetry indicates that attackers bypass these filters by routing credential-stuffing and database port scans through compromised home devices like smart plugs, IP cameras, and home routers. These devices often run lightweight Linux packages with default credentials exposed to the public web, making them easy targets for botnets. By routing traffic through these residential nodes, attackers blend in with normal household internet usage, rendering traditional <a href="/blacklist-check" class="text-blue-500 hover:text-blue-600 dark:text-blue-400 dark:hover:text-blue-300 underline font-medium">IP blacklist systems</a> ineffective.
- Residential Proxy Hijacking: Over 64% of credential stuffing and automated bot scans now route through <a href="/blogs/how-vpns-actually-work" class="text-blue-500 hover:text-blue-600 dark:text-blue-400 dark:hover:text-blue-300 underline font-medium">residential proxy networks</a>. This is a dramatic increase from 38% in late 2024, demonstrating that bad actors are actively avoiding datacenter ASNs to evade signature-based firewall systems.
- Brute-Force SSH Campaigns: Port scanning on ports 22, 2222, and 5022 originating from cloud hosting networks grew by 18%, highlighting that attackers still maintain high-bandwidth command-and-control servers inside traditional hosting nodes.
- CGNAT Evasion Patterns: Mobile network connections (cellular carriers using dynamic CGNAT blocks) are increasingly exploited to run web scrapers and checkout bots, as security teams cannot block the dynamic carrier IP without accidentally blocking thousands of legitimate mobile subscribers.
Global IPv6 Adoption & Peering Efficiency Report 2026
This comprehensive networking study evaluates the deployment, performance, and BGP routing efficiency of <a href="/blogs/what-is-ipv6" class="text-blue-500 hover:text-blue-600 dark:text-blue-400 dark:hover:text-blue-300 underline font-medium">Internet Protocol Version 6 (IPv6)</a> across global consumer and enterprise networks. Although global IPv6 availability has climbed to an impressive 43.2% of routed traffic, our diagnostic tests show that legacy peering configurations and routing table anomalies introduce noticeable latency penalties. In many cases, IPv6 <a href="/traceroute" class="text-blue-500 hover:text-blue-600 dark:text-blue-400 dark:hover:text-blue-300 underline font-medium">routing paths</a> exhibit 12-15% slower round-trip times than equivalent IPv4 paths. This discrepancy is caused by the lack of direct IPv6 peering agreements at regional Internet Exchange Points (IXPs). Because Tier-2 and Tier-3 ISPs frequently aggregate their IPv6 traffic and route it through distant transit nodes instead of establishing local connections, packets often travel thousands of miles out of their way. Resolving this performance gap is essential for completing the transition to an IPv6-only web, especially as IPv4 address exhaustion continues to drive up lease costs. We also examine 6to4 translation issues, transit provider constraints, and BGP table aggregation behaviors that shape the modern IPv6 ecosystem.
- Latency Overhead: IPv6 routing paths exhibit an average latency penalty of 12-15% compared to IPv4. In developing regions like South America and South Asia, this penalty averages 38ms due to suboptimal peering agreements.
- Mobile Carrier Dominance: Mobile carrier networks lead global IPv6 adoption with an 88% deployment rate. Mobile providers have transitioned to IPv6-only cores, using NAT64 translation at the edge to manage IPv4 traffic.
- Enterprise Lag: Enterprise internal networks remain the primary bottleneck. Only 18% of surveyed corporate intranets support native IPv6 routing, due to concerns over legacy firewall compatibility and routing complexity, which we have analyzed in our network transition <a href="/case-studies" class="text-blue-500 hover:text-blue-600 dark:text-blue-400 dark:hover:text-blue-300 underline font-medium">case studies</a>.
VPN & Proxy Usage Trends & Security Report 2026
This report tracks the expansion of commercial <a href="/vpn" class="text-blue-500 hover:text-blue-600 dark:text-blue-400 dark:hover:text-blue-300 underline font-medium">Virtual Private Networks (VPNs)</a> and the concurrent rise of residential proxy networks, drawing on public ISP-classification and proxy-network research. Privacy-focused browsing and automated scraping bots are changing internet traffic patterns, with a meaningful and growing share of daily web requests transiting through VPN or proxy infrastructure. While commercial VPNs are primarily used by consumers seeking privacy and bypasses for regional restrictions, residential proxy networks are heavily leveraged by botnet programmers. By routing automated scripts through home connections, botnets easily bypass standard web application firewalls (WAFs). This report highlights the mechanisms behind residential proxy recruitment, the security threats they pose to e-commerce checkout systems, and the forensic signatures network administrators can use to detect them. We look at open-source proxy SDK bundles, DPI techniques, MTU metrics, and TLS fingerprint matching.
- High Proxy Traffic: 31% of analyzed web requests route through VPN or proxy servers. This represents a significant increase from 22% in 2024, driven by consumer privacy adoption.
- Residential Proxy Scalping: E-commerce botnets rely heavily on SOCKS5 residential proxy networks. Over 72% of scalping campaigns use these IPs to bypass store purchase limits.
- Bandwidth Harvesting SDKs: Many residential proxy networks recruit home IPs by embedding bandwidth-sharing software development kits (SDKs) inside free consumer applications, as explored in our cybersecurity threat <a href="/case-studies" class="text-blue-500 hover:text-blue-600 dark:text-blue-400 dark:hover:text-blue-300 underline font-medium">case studies</a>.
Global Domain Name System (DNS) Security & Trends Report 2026
This security research study audits the configuration health, mail server authentication settings, and DNSSEC adoption rates of the top 10,000 global enterprise domains. The <a href="/blogs/dns-explained" class="text-blue-500 hover:text-blue-600 dark:text-blue-400 dark:hover:text-blue-300 underline font-medium">domain name system (DNS)</a> is a critical component of internet infrastructure, but it remains a common target for cyberattacks. Our findings expose widespread security vulnerabilities, with 65.8% of top enterprise domains failing to sign their zones with DNSSEC (Domain Name System Security Extensions). This leaves organizations exposed to DNS cache poisoning, where attackers redirect users to fake phishing websites. We also observed significant gaps in email authentication configurations, with 18% of domains lacking valid SPF, DKIM, or DMARC records, making it easy for scammers to spoof their email addresses. This report outlines the current state of DNS security, explains the risks of cache poisoning, and provides actionable recommendations to secure your domain configurations, roll signatures, manage TTL values, and implement CAA filters.
- DNSSEC Exposure: 65.8% of top-tier global enterprise domains do not sign their zone records. This leaves them vulnerable to DNS cache poisoning and man-in-the-middle attacks.
- Mail Authentication Gaps: 18% of domains have missing or misconfigured SPF, DKIM, or DMARC records. This allows spoofed phishing emails to pass through standard spam filters. Administrators can check their domain parameters as explored in our brand protection <a href="/case-studies" class="text-blue-500 hover:text-blue-600 dark:text-blue-400 dark:hover:text-blue-300 underline font-medium">case studies</a>.
- TTL Misconfigurations: 24% of domains use TTL values exceeding 86,400 seconds (24 hours). High TTL values delay failover propagation during outages, extending website downtime.
Global ISP Routing Performance & Market Share Report 2026
This networking study analyzes the peering speeds, latency jitter, and BGP routing stability of major Tier-1 internet carriers globally. We evaluate transit paths across major transoceanic fiber links, highlighting how peering point congestion and fiber backbone saturation directly impact end-user application latency. BGP route leaks, path hijacking, and carrier transit bottlenecks can lead to traffic routing anomalies, packet loss, and latency spikes. To address these vulnerabilities, we explore the implementation of RPKI (Resource Public Key Infrastructure) in securing BGP routes and verify route origin authorizations. We compare peering efficiency at major Internet Exchange Points (IXPs) and examine how Content Delivery Networks (CDNs) are bypassing traditional carrier paths to establish direct connections with consumer ISPs. This analysis includes evaluation of Tier-1 routing paths, undersea link constraints, routing protocol engineering, and transit metrics across AS3356, AS1299, and AS6453.
- BGP Leaks: BGP route leakage events increased by 14% year-over-year, leading to traffic routing anomalies and packet loss. This forces packets to take longer routing paths. We analyze the impact of routing policies on local nodes in our BGP routing <a href="/case-studies" class="text-blue-500 hover:text-blue-600 dark:text-blue-400 dark:hover:text-blue-300 underline font-medium">case studies</a>.
- Transpacific Congestion: Transpacific undersea fiber connections operate at 84% capacity during peak hours, causing latency spikes.
- Jitter Discrepancy: Broadband connections in developing countries experience up to 5x higher latency jitter than fiber connections in Europe and East Asia.
Network Class Threat Mapping
This index represents our active firewall data. It outlines the threat severity levels of traffic routing through different categories of Autonomous System Numbers (ASNs).
| Network Category | Threat Severity Index | Primary Representative ASN | Forensic Activity Detail |
|---|---|---|---|
| Hosting / VPS Network | High (82%) | AS14061 (DigitalOcean) | High-frequency port scanners and outbound API bots. |
| Consumer Broadband | Low (4%) | AS7922 (Comcast Cable) | Legitimate residential traffic, occasional malware bot leaks. |
| Mobile / Cellular Carrier | Medium (38%) | AS21928 (T-Mobile USA) | Dynamic CGNAT address blocks, transient scraper bots. |
| Dedicated Business Fiber | Very Low (<1%) | AS7018 (AT&T Services) | Highly clean connections, dedicated corporate traffic. |
Frequently Asked Questions
Find detailed answers to common inquiries about IP addressing, autonomous system mapping, BGP routing anomalies, and domain zone security protocols.
Access Raw Network Telemetry
Get our weekly threat indices, IP blocklists, and routing latency datasets delivered in JSON/CSV formats directly to your engineering inbox.