Internet Integrity Workshop III: Residential Proxies

Following the discussions at previous workshops from the Global Cyber Alliance (GCA) that focused on actionable data and collective action, this working session will address an operational challenge: attacks originating from infected Internet infrastructure and impacting others at scale. A growing share of malicious activity, such as botnets, residential proxies, scanning, and exploitation, originates not from dedicated attacker infrastructure, but from compromised or misused legitimate networks.

This workshop aims to move beyond general discussion toward a more structured exploration of:

• What do we collectively know, and what flies under the radar about residential proxy abuse?
• What would a realistic “good state” of mitigation look like, focusing on containment, detection speed, and reduction of systemic harm rather than elimination?
• Which actors can meaningfully influence outcomes? What resources do they need and lack? Where are there coordination gaps?
• What small but concrete collective actions could be pursued within 6–12 months?

Leslie Daigle (Chief Technical Officer & Internet Integrity Program Director at GCA) will offer a summary of the session at the Security WG Meeting on Tuesday, 19 May (16:00 – 17:30).

A final report with a list of agreed next steps will also be published in the weeks after RIPE 92.