Topic starter
11/08/2026 3:13 pm
TL;DR: A 633-server anonymization network, CanOworms, that commodity malware operators and suspected state-linked actors use to hide attack origin behind disposable relays and defeat IP blocklists and reputation scoring has been mapped by SecurityScorecard's STRIKE team. Shared proxy infrastructure is now a durable operational layer for intrusion concealment, not just a nuisance feed issue.
Editorial analysis by NHI Mgmt Group, based on content published by SecurityScorecard: “Inside CanOworms: The 633-Server Proxy Network Hiding Criminal and State-Linked Activity”.
Key questions
Q: What fails when attackers route traffic through rented proxy networks?
A: IP reputation, geolocation, and simple blocklists lose much of their value because they describe the relay, not the actor.
Q: Why do rented relays make attribution harder for defenders?
A: Because many tenants can share the same exit infrastructure, the public address no longer identifies a single operator.
Q: How can security teams detect proxy-for-hire infrastructure more reliably?
A: They should correlate stable technical traits such as TLS certificates, JARM, JA4X, and repeat traffic behaviour across time.
Practitioner guidance
- Prioritise fingerprint-based detection Use TLS certificate traits, JARM, and JA4X together so a relay can still be recognized after its IP changes.
- De-emphasise source IP in triage Treat blocklists and geolocation as supporting evidence only when the same relay pattern appears across multiple observations.
- Separate relay ownership from relay use Document whether an observed host is a likely proxy service, a disposable relay, or a true attacker-controlled node before you escalate attribution.
Bottom line: Rented proxy networks weaken the assumption that source IP reflects attacker identity, which makes traditional blocking and reputation controls far less reliable.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 hours ago by NHI Mgmt Group
11/08/2026 3:27 pm
Rented proxy infrastructure creates an attribution gap, not just an evasion trick. The practical problem is that defenders often still treat public IPs as if they were stable identities. In a shared relay market, the address belongs to the service layer, while the attacker identity lives behind it. Practitioner takeaway: attribution and response need evidence from fingerprints, telemetry, and campaign behaviour, not source address alone.
A question worth separating out:
Q: What should incident responders do when a malicious IP may be a rented proxy?
A: They should avoid treating the address as the end of the investigation. The better response is to preserve the fingerprint set, map related nodes, and look for shared behaviours that reveal the relay service behind the activity before making containment or attribution decisions.
👉 Read our full editorial: CanOworms shows how rented proxy networks obscure attacker origin
This post was modified 4 hours ago by NHI Mgmt Group