Uploaded June 2026 | Updated September 2026, 1 week ago
Abstract
At NANOG 94, we warned that DDoS attackers had weaponized the more than 100 million endpoints in the global residential proxy ecosystem. The following 12 months bore out that warning: Kimwolf residential proxies launched record breaking attacks in the tens of terabits per second across thousands of incidents, including several that disrupted critical infrastructure. One year on, this talk assesses what has and hasn't changed. Law enforcement actions and provider takedowns significantly degraded Kimwolf, but successor botnets rapidly filled the void using the same residential exploits. More concerning, daily active DDoS botnet endpoints climbed from roughly one million in summer 2025 to over eight million today, and aggregate bandwidth capacity remains in the hundreds of terabits per second. We close by examining the industrial-scale AI scraping demands driving residential proxy growth and what this means for defenders.
This talk is joint research between Comcast Threat Research Lab (CTRL) and Nokia Emergency Response Team
Craig Labovitz:
Craig Labovitz is Head of Technology for the Nokia Deepfield business line. Previously, Labovitz was Founder and CEO of Deepfield and Chief Architect for Arbor Networks. Labovitz is the author of more than a dozen peer-reviewed networking research papers, journal articles and patents. Dr. Labovitz received his PhD and MSE from the University of Michigan.
nanog.org/events/nanog-97/content/5771
Abstract
At NANOG 94, we warned that DDoS attackers had weaponized the more than 100 million endpoints in the global residential proxy ecosystem. The following 12 months bore out that warning: Kimwolf residential proxies launched record breaking attacks in the tens of terabits per second across thousands of incidents, including several that disrupted critical infrastructure. One year on, this talk assesses what has and hasn't changed. Law enforcement actions and provider takedowns significantly degraded Kimwolf, but successor botnets rapidly filled the void using the same residential exploits. More concerning, daily active DDoS botnet endpoints climbed from roughly one million in summer 2025 to over eight million today, and aggregate bandwidth capacity remains in the hundreds of terabits per second. We close by examining the industrial-scale AI scraping demands driving residential proxy growth and what this means for defenders.
This talk is joint research between Comcast Threat Research Lab (CTRL) and Nokia Emergency Response Team
Craig Labovitz:
Craig Labovitz is Head of Technology for the Nokia Deepfield business line. Previously, Labovitz was Founder and CEO of Deepfield and Chief Architect for Arbor Networks. Labovitz is the author of more than a dozen peer-reviewed networking research papers, journal articles and patents. Dr. Labovitz received his PhD and MSE from the University of Michigan.
nanog.org/events/nanog-97/content/5771
