Selfhosted

if I aggressively block each offender in my logs permanently, then the next person assigned this IP who may be a legitimate user will be unable to access my site.

temp bans exist for this reason. You can use something like fail2ban for it, or that may be overkill for your purposes, but any mechanism that blocks the IP address for a short amount of time will work. My f2b blocks spammers' IP addresses for a day, and I don't see repeat bans which means the spammers aren't coming back on the same IP address, so the short ban works to stop a given spam attack.

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

7 acronyms in this thread; the most compressed thread commented on today has 9 acronyms.

[Thread #23 for this comm, first seen 22nd Jun 2026, 20:20] [FAQ] [Full list] [Contact] [Source code]

I worked as a network analyst for a provider for several years and during that time I'd say ~90% of the issue stemmed from sketchy apps/services that the user loaded from their end.

A lot of "free" VPN services will basically allow bad actors (the paid tier) to use your connection. A lot of IoT devices are also just openly available on the Internet to route through.

From the ISP perspective, we managed the roads, not your car. There is a push to blame the ISP as it's their network, but realistically how are they meant to provide security (in the context that is being asked) to any device that gets plugged into that network? We even had business customers demand we add clauses to contracts where we would accept responsibility for any malware they sent between sites over an MPLS setup.

In the end, a lot of people seem to want this impossible scenario of the ISP managing security for them but also not inspecting their traffic.

Residential routers have crappy security 'cos no-one bothers to punish ISPs for crap security practices.

Also some free VPNs come at a malware cost.

There was an article here about one of the companies doing this, basically one of the methods is having apps on people's smart TVs or phones that scrape the web in the background and upload to a control server. So it's a person's genuine device in a genuine residence in some cases.

https://thehackernews.com/2026/06/free-apps-are-quietly-turning-smart-tvs.html

All of the above.

Is it that ISPs are being paid by tech-bros to assign them these IPs?

Bullet Proof Hosting is a thing. Some ISPs basically advertise to criminals about their ability to evade take down orders and unwillingness to work with law enforcement. So, some infrastructure ends up on these devices. However, the IP ranges from these services often get discovered and are added to public reputation and block lists.

Along side this, cloud providers are pretty bad about policing their networks. On my own home server, I have blocked much of the Digital Ocean IP space, as it's home to a lot of scanners, bots and other malicious traffic.

Is it that residential devices have been hacked /contain malware that does this?

This happens, a lot. The Mirai Botnet thrived on compromised home routers. People are pretty bad at updating their devices and many SOHO routers ship with some pretty bad vulnerabilities. It's only a matter of time until someone finds an unpatched or misconfigured router and adds it to a botnet. People also get phished or install trojans all the time, adding to botnets. Darknet Diaries just had a fantastic episode on the Bayrob malware, part of which was turning infected machines into a custom botnet.

Is it trivial for companies to assign themselves residential IPs?

Some ISPs just look the other way when they get reports of malicious activity on their network. Also, attackers can force a DHCP refresh and just get a new IP when the old one seems blocked. Getting one in the first place is often as simple as signing up for service and/or compromising someone's home PC and using it as a relay.

Paid volunteers are doing this for AI companies?

This probably happens. Afterall, we've already seen a company selling an AI product which was just workers in India.

Obviously this is a problem because one can rotate / cycle through residential IPs and if I aggressively block each offender in my logs permanently, then the next person assigned this IP who may be a legitimate user will be unable to access my site.

Look into Fail2Ban. This program monitors your logs and will ban IPs automatically based on criteria you set. This can include specific HTTP requests in your web logs. The ban can be permanent or can be time limited. For example, I have a container running in a cloud provider which I use to proxy requests through my ISP's CGNAT setup. There is an NGinx reverse proxy running there and I have fail2ban watching the access log. If certain request strings are seen, the sending IP gets dumped in a permanent jail. I also have it scanning the sshd logs and banning IPs which fail to login 3 times within a short period.

It's far from a silver bullet, but it's something which should be running on any web facing system. Attackers will always be rattling the door knobs. There is no reason to let them keep rattling away.

Not the ISPs problem at all.

Blame IoT manufacturers for providing shit devices that can easily be hacked.

Theere is no difference from a technical standpoint between a business and residential IP. It's allocation is tied to the network provider.

People install extensions onto browsers for any number of reasons without knowing what it does. It was a problem is the 90s that never went away.

As often as im Blocked as supposed bot/crawler, have you given tough to misidentifiying users as bots?

They use hundreds of smart phones with data plans.