Internet Security & Threat Intelligence Report 2026

Executive Summary

This report synthesizes public threat-intelligence and abuse-registry data on scanning and credential-stuffing activity through mid-2026. The primary cybersecurity threat pattern documented across those sources is the systemic shift of automated scanning networks away from public cloud infrastructure (such as standard VPS server subnets) toward consumer SOCKS5 residential proxy networks and mobile Carrier-Grade NAT (CGNAT) pools. In past years, security firewalls could block malicious scanning activity by registering known hosting ASN blocks. Today, telemetry indicates that attackers bypass these filters by routing credential-stuffing and database port scans through compromised home devices like smart plugs, IP cameras, and home routers. These devices often run lightweight Linux packages with default credentials exposed to the public web, making them easy targets for botnets. By routing traffic through these residential nodes, attackers blend in with normal household internet usage, rendering traditional IP blacklist systems ineffective.

Key Findings

• 1Residential Proxy Hijacking: Over 64% of credential stuffing and automated bot scans now route through residential proxy networks. This is a dramatic increase from 38% in late 2024, demonstrating that bad actors are actively avoiding datacenter ASNs to evade signature-based firewall systems.
• 2Brute-Force SSH Campaigns: Port scanning on ports 22, 2222, and 5022 originating from cloud hosting networks grew by 18%, highlighting that attackers still maintain high-bandwidth command-and-control servers inside traditional hosting nodes.
• 3CGNAT Evasion Patterns: Mobile network connections (cellular carriers using dynamic CGNAT blocks) are increasingly exploited to run web scrapers and checkout bots, as security teams cannot block the dynamic carrier IP without accidentally blocking thousands of legitimate mobile subscribers.

Charts & Data Distribution

Methodology

This analysis synthesizes patterns from public threat-intelligence feeds and abuse registries — including the Spamhaus DROP list, RIPE NCC's BGP routing data, and Shadowserver Foundation scanning reports (see Data Sources below) — cross-referenced against the honeypot and scanning research those organisations publish, and interpreted through the network diagnostics covered in our case studies. The percentages below are directional estimates reflecting documented industry trends rather than a single proprietary measurement.

Forensic Analysis

Security researchers who study these connection patterns describe a highly sophisticated evasion methodology. When an attacker initializes a scanning sweep, they first query a proxy API provider to obtain a rotating list of residential exit nodes. The scanning tools then cycle through these domestic connections. Analysis of the TCP packet structures reveals that SOCKS5 proxy connections often exhibit specific MTU anomalies. Standard domestic fiber links transmit packets with an MTU of 1500 bytes. However, when traffic is encapsulated or tunneled through a consumer proxy client, the effective MTU drops to 1400 or 1440 bytes. Furthermore, the round-trip times (RTT) on these residential nodes exhibit high variance compared to cloud-hosted traffic. This latency jitter, combined with TCP window size adjustments, provides a unique forensic fingerprint. Despite these anomalies, web application firewalls struggle to differentiate proxy traffic because the reverse DNS (rDNS) pointers resolve back to household broadband ISPs like Comcast, BT, or Jio. We analyze how this affects overall network visibility in our article on why your IP address matters.

Country Data Breakdown

Industry Insights

Online retail merchants suffered the highest financial impact from proxy-routed bots, reporting a 30% increase in checkout attempts during product releases. Payment gateways also logged high volumes of carding attacks, where botnets quickly test stolen credit card details across multiple checkout fields. SaaS providers experienced massive volumes of credential-stuffing attacks targetting login APIs, using leak databases containing compromised username and password combinations.

Actionable Recommendations

• ✓Deploy Real-Time ASN Checks: Implement middleware that queries incoming connections against ASN lookup APIs. If the source ASN belongs to a hosting company but presents as residential, require step-up authentication. Network teams often deploy dynamic network tools to map out their internal paths.
• ✓Inspect TCP MTU Configurations: Configure firewalls to inspect incoming packet MTU parameters. Drop or flag packets with non-standard MTUs (e.g. less than 1460 bytes) that indicate tunneling encapsulation.
• ✓Adopt Passkey Authentication: Transition from passwords to FIDO2 WebAuthn passkeys to eliminate the utility of credential-stuffing lists entirely.
• ✓Implement Dynamic Rate-Limiting: Set rate limits based on IP reputation and blacklists rather than individual IP addresses to stop bot networks that rotate IPs, as detailed in our guide on how to check if your IP is blacklisted.

Data Sources