Databricks on Thursday announced a new round of funding that values the company at $188 billion. The round was led by Coatue.

Databricks didn’t disclose exactly how much it raised; it said the money isn’t in its hands yet and that the round will close later this summer. (Other outlets have since reported the raise is roughly $3 billion.) While it’s unusual for a company to announce before it gets the money, a VC tells TechCrunch that the deal is solid, with so many firms wanting in that the company had no reason to keep its shiny new valuation a secret.

In fact, Databricks has been on a year-and-a-half fundraising tear as it successfully transitioned its image into an AI provider and not just a yesteryear SaaS sensation. Yesteryear being back in the BC times (Before ChatGPT).

Only five months ago, in February, Databricks closed a $5 billion Series L raise at a $134 billion valuation. Five months before that, in September 2025, it raised $1 billion at a $100 billion valuation. And roughly nine months before that, in December 2024, it raised what was a record-breaking round at the time of $10 billion at a $62 billion valuation.

Databricks has raised so many rounds over the years that this latest one became the subject of memes about running out of letters of the alphabet. “Turning on alerts for when we get a Series AA,” one person posted.

But its image reconstruction has been legit. Founded in 2013, it initially grew to success back in the big data era, with software that enabled enterprises to store enormous amounts of data in the cloud, yet produce speedy analytics.

Because it already sat on troves of enterprise data, Databricks was then well-positioned to respond as companies started wanting AI with the same security and governance they expect from traditional enterprise software.

The company began rolling out one AI product after another, like Lakebase, its database built for AI agents, and Unity, its AI gateway, along with a “meta-harness” called Omnigent that manages multiple agents.

Databricks also increasingly became known as one of the big examples of enterprises adopting more affordable Chinese-based open-weight models (models whose underlying code is published for anyone to use and modify) for cost control, one of the big trends of 2026. It is a particular champion of Z.ai’s GLM 5.2 as a model for coding.

Last week Databricks CEO Ali Ghodsi shared the results of some internal benchmarking done to manage his own AI costs for his 3,000 software engineers.

The company compared AI models on the actual tasks its programmers do. Not surprisingly, in the blog post revealing the results, Databricks shared that “open models, and GLM 5.2 in particular, are now able to handle even the highest level of task difficulty” in coding, and at a total lower cost than proprietary models from Anthropic and OpenAI.

But it did surprise people by finding that the choice of harness — the agentic coding tool, like Codex or Claude Code, that wraps around a model and manages its context and instructions — equally impacted costs. It found that open-source harness Pi to be one of the best at managing context surrounding each prompt, and therefore one of the lowest costs choices without sacrificing quality.

“The lesson here isn’t that one harness is always cheaper or that native harnesses are worse,” the post declared. “Instead, model choice is only one piece of the puzzle.”

All of this has added to Databricks image as an AI company, even if it wasn’t founded as an AI lab. This, in turn, has granted it the AI-halo for raising money and leaping its valuation. As we previously reported, the AI effect is so strong these days, that even sandwich shop Jersey Mike’s mentioned AI 22 times in its S-1 documents.

One of the most interesting BSD variants of the 2010s, NextBSD, has come back to life under new management. The Reg FOSS desk is intrigued.

Aside from the homepage, there’s a GitHub repository – but beware, this is separate from the old one, whose repo is still there although the most recent changes were seven years ago. The new project also has a project history giving credit where it’s due.

The main man behind the revival is Joe Maloney, known on GitHub as pkgdemon. In case his name rings a bell, we’ve mentioned him before: he put together the Gershwin desktop in GhostBSD. Soon after we covered Gershwin on GhostBSD, he asked the maintainers if he could take over the NextBSD project. He did have a relatively minor role in the original – you can see his list of commits.

The original NextBSD project was started by FreeBSD co-founder Jordan Hubbard in 2015 – its Wikipedia article has some of the history. The plan was to port some of the components of Apple’s Darwin OS to FreeBSD. Darwin is the Unix foundation on which macOS and Apple’s other OSes are built: it’s open source and the code can be pulled direct from GitHub. Some of the initial goals are explained in this presentation from the original team.

The reasoning goes like this… Apple’s various operating systems, from macOS to iOS to the cut-down ones in the Apple Watch and Apple TV, are all built from a single common core, derived from NeXTstep. That was built on Mach and BSD UNIX, which were Free Software – the term “open source” didn’t exist yet. Apple’s OSes are sophisticated, highly developed, and are used in billions of customer-facing devices with next to no technical support.

Today, much of Apple’s OSes are open source. Along with the XNU kernel, which handles inter-process communication using Mach IPC, there’s its init system launchd, IOkit for handling devices and drivers, the Apple System Log facility and its logging daemon syslogd, and much more.

Although Apple shares much of the BSD-based text-mode parts of its OS, the lower-level parts – the XNU kernel and drivers – are designed and built purely for Apple hardware. When OS X was still quite new, there were various efforts to take the Darwin OS and build versions for PC hardware. OpenDarwin started in 2002, but ended in 2006. It was followed by PureDarwin, which put out releases in 2015 and 2019, and was still maintained as recently as 2024. There were others, including GNU Darwin and DarwinBSD.

Just how difficult it is to make this all work is demonstrated by the way that all these projects ultimately faltered or ended. So the NextBSD plan is to take the FreeBSD kernel, the most capable of the FOSS BSD kernels, but replace FreeBSD’s traditional and server-focused userland with the relevant parts of the publicly available Apple code.

The rebooted NextBSD-redux is not based on a fork of the decade-old code. FreeBSD has moved on substantially in that time, and so have macOS and Darwin. This is a new project by a new developer, but it picks up the same overall plan, aims to assemble the same puzzle pieces, and shares the same intended goal.

In places, it does draw on a little of the same code, though. The NextBSD-redux README describes what’s working so far, with a lot more detail in the porting notes. Although there’s no graphical desktop yet, that’s underway as well. Naturally enough, it’s Maloney’s own Gershwin, and the current status is described in the gershwin-on-nextbsd repository.

For us, perhaps the key aspect of NextBSD – both the original version and NextBSD-redux – is that it isn’t an effort to build something completely new from scratch. It’s an effort to cherry-pick and combine elements of existing separate FOSS projects, and assemble them into a useful whole.

The inspiration it shares with Maloney’s Gershwin desktop is clear. Gershwin combines components taken from the GNUstep Project, plus the window manager from the Xfce desktop, plus other components, aiming to create a broadly Mac-like desktop environment.

Outside of the efforts to create a FOSS PC OS based on Apple Darwin, or a Mac-like desktop environment, there have been several other efforts to create a macOS-like OS from existing FOSS parts. What’s encouraging is that many of them share code with one another.

Gershwin on GhostBSD was not the first effort to put a macOS-like desktop on a BSD OS. In 2023, we reported on helloSystem 0.8. It was the second look at this prototype OS in The Register after an earlier article in 2021. helloSystem was being put together by Simon “ProbonoPD” Peter, the creator of the AppImage cross-distro packaging format. helloSystem was based on a graphical distro of FreeBSD called FuryBSD, but unfortunately that project shut down in 2020. ProbonoPD moved over to help with Gershwin development instead.

helloSystem was not ProbonoPD’s first rodeo either. Before that, he had a Linux-based live distro based on GNUstep, called LIVEstep, and he was also one of the core team behind PureDarwin. 

In the same vicinity, there is also a very ambitious project called ravynOS. As its FAQ file back in 2022 acknowledged: “We have been in fact working with helloSystem! As some people have noticed, Release 0.2.X was basically helloSystem. (That was the second PoC. The first had been built on vanilla FreeBSD and had no GUI at all.)”

Although ravynOS may have started out as a fork of helloSystem, it was more ambitious. From its early days, it aimed for some limited degree of macOS binary compatibility, thanks to a project called Darling. These days, its architecture starts with Darwin 19.6, which corresponds to macOS 10.15 “Catalina.” The new NextBSD uses some of ravynOS’s libraries, such as the libxpc library, which came out of the original NextBSD project.

Maloney went public with his rebooted NextBSD project in May. He mentioned it in a Reddit comment and then explained more in a thread titled “NextBSD – the BSD of the 21st century.”

There’s one aspect of the project restart that will alienate some people, though: he is using AI. The Team section of the homepage says it’s Maloney and Anthropic’s Claude Code.

We asked him how and for what he was using it. He told The Register: “From my perspective, AI is a force multiplier here. It is my team of developers, but I am steering the entire thing. I can understand that won’t be for everyone. If others happen to like it, awesome. If others happen to contribute later, awesome. I selfishly just enjoy doing it, and want it to exist for myself. I can think of no better name for the project than NextBSD.

“I get and understand the skepticism around AI people have, because I am not sure how much I trust AI-generated code myself, especially without review from humans. In my case, AI has always been more of an effort to accelerate my knowledge of what code does faster, versus not learning anything. With that said, I would still understand the reservations people would have in production environments.”

At the moment, the oldest commits in the nextbsd-redux repository are only two months old. He told us that he didn’t do all this development in just that brief period.

“I’ve had two iterations of this work before anything migrated outside of my personal GitHub account into an org. The first iteration was entirely vibe coded just to see if it could be done with a sockets-only version of launchd, without Mach and LaunchDaemons for devmatch and devd.

“The entire time, I was documenting everything extensively at pkgdemon.github.io. I did things like compare FreeBSD’s mechanisms for kernel module loading to Linux and Darwin. I figured out what the gaps were. I confirmed that Darwin had solutions to fill the gaps that I wanted to fill, but I would need Mach. This is where I started using AI more heavily for months of just planning, researching, refining plans.

“So for the second iteration, I repeated the same work with just a Mach kernel module only, and launchd in a single repo. Then I took a few things like libxpc, last updated by RavynOS, and first created by the original NextBSD developers to act as the glue for launchd bootstrap. There were a few glue components like that, where there were no code drops from Darwin that NextBSD had written alternatives for, and rayvnOS continued to carry forward. That is where the NextBSD original code lives on; the rest is clean room. This is also where I began to more interactively review every code change with Claude Code developing automated testing all the way through – starting only with a Mach kernel getting loaded, let’s write tests that cover every part of it, etc.

“Specifically for the third iteration, I broke everything out into repos for things like the kernel itself, modules to be converted to kexts, the superset of tooling from Darwin. This is where I moved to cross building everything natively in GitHub with automated tests to gate everything. So in that sense, AI tooling is involved in almost every stage of things still, but so am I if that makes any sense.”

This vulture is intensely skeptical about the use of LLMs for writing code, but for such an interesting experiment as this, we’re willing to suspend our disbelief. Currently, NextBSD is more about experimentally trying to bring together components and code from very different sources, and get them working together. We’d be fascinated to see if NextBSD can get to the stage of being a working OS that can run on a laptop, bringing elements of Apple’s userland to FreeBSD’s very solid kernel. We’re happy to see this project back and in active development, and we hope it delivers interesting results. ®

Two sides with less-than-clever records meet on Matchday 3 of the Nations Championship 2026 as Australia host Italy in Perth. Joe Schmidt takes charge of the Wallabies for the final time with both teams desperate to avoid ending the Southern Hemisphere Series with three defeats from three.

Schmidt has more than a little pride on his agenda to go out on high. His Wallabies side are on a six-game losing streak, winning just one of their past 10 outings. Another defeat here and Schmidt will end an ignominious two-year spell with the lowest win percentage of any Aussie coach in the professional era. The Kiwi has kept faith with Declan Meredith at fly half after last weekend’s 42-26 loss to France, with Ben Donaldson returning to the bench. Local Perth hero Carlo Tizzano gets the nod in the back row, with Fraser McReight on the bench. Max Jorgensen again starts on the wing.

In late May, Neil Rimer said something during a sit-down I had with him in Athens that I haven’t been able to shake. At a vibrant new tech festival in the city, talking about the wealth piling up around AI, he said he has “a strong sense that there will be some sort of a redistribution.” He continued on. “It’ll either be voluntary or it’ll be involuntary, but it’ll happen, and I hope it’s voluntary,” he told me, adding that he thinks tech leaders “can play a leading role in seeing that through.”

Coming from most people, that would sound like standard-issue populism. Coming from Rimer, a co-founder of Index Ventures, one of the most successful venture firms of the last three decades, it seemed a striking thing to say in public.

Rimer stepped back from day-to-day investing in 2021, and these days spends much of his time in Athens, where his wife is from and where his children treasure their Greek passports. He turned up to our interview in a rumpled button-down and jeans, not the quarter-zips and fine knitwear that mark so many of his peers. Yet Index’s returns in recent years have been exceptional: the firm has raised roughly $15 billion from outside investors since its founding, and last year’s exits including Figma’s IPO and Google’s purchase of the cybersecurity firm Wiz reportedly netted Index roughly $9 billion.

Rimer has found ways to give back. He sits on the board of Endeavor Greece, which mentors entrepreneurs in emerging markets, and chaired the board of Human Rights Watch from 2019 to 2025. In late 2021, he and his father and two brothers gave $13 million to McGill University to renovate a campus building, now the Rimer Building, and found a new Institute for Indigenous Research and Knowledges.

In the meantime, his comment about redistribution comes at an odd moment, to be charitable, for giving. The Giving Pledge, the promise Warren Buffett and Bill Gates launched in 2010 to get billionaires to commit half their fortunes to charity, is becoming increasingly irrelevant. One hundred and thirteen families signed in its first five years, then 72, then 43, then just four in all of 2024, per a New York Times report in March that underscored how out-of-fashion philanthropy has become among some of the richest people in tech. (Noted that piece: “Elon Musk, the world’s wealthiest person, has said that his businesses ‘are philanthropy.’”)

The pattern appears to hold beyond the Pledge. Total American charitable giving hit a record $592.5 billion in 2024, but the number of Americans actually giving has fallen for five straight years, down 4.5% in 2024 alone, according to the Stanford Social Innovation Review. Two-thirds of households donated in 2000; roughly half do now, and Bank of America and Lilly Family School data shows even affluent-household giving has slipped, from 90% in 2017 to 81% last year.

The pattern shows up in Index’s own portfolio, too, which includes Anthropic. Business Insider recently asked a financial planner, Alex Caswell, whether his newly wealthy clients, many of them Anthropic employees tied to effective altruism, were pledging to give away the bulk of their fortunes. Anthropic matches employee donations of up to 25% of their equity to charity, and some of Caswell’s clients have used it, he told BI, but most weren’t building philanthropy into their plans at all; they were focused on angel investing or starting their own companies. “That’s what I’m seeing more than the desire to become philanthropic,” he told the outlet.

Unsurprisingly, the absence of voluntary giving is now running up against attempts to legislate the outcome instead. California voters will decide this year on a 5% one-time wealth tax that targets the state’s billionaires. Some, including Google founders Sergey Brin and Larry Page, have already moved their primary residences to South Florida to be on the safe side.

OpenAI is reportedly considering going public in 2027, and cynically, one reason among others may be that the tax, if passed, will calculate net worth based on an individual’s worldwide assets as of the end of this calendar year.

As unsurprisingly, there is plenty of opposition to any kind of wealth-redistribution measure of this scale, including by Governor Gavin Newsom, and including by economists who point out that many industrialized countries have repealed similar wealth taxes since 1990 after watching their wealthy residents skedaddle.

Other options on the table are as controversial. OpenAI has reportedly discussed handing the federal government a 5% equity stake, an idea CEO Sam Altman has framed as sharing AI’s upside with the public, but critics see it instead as a way to buy political cover in Washington. In either case, Silicon Valley has never been eager to put Uncle Sam on the cap table. Joked veteran investor Roelof Botha during a separate sit-down with this editor last year: “[Some] of the most dangerous words in the world are: ‘I’m from the government, and I’m here to help.’”

It’s worth thinking through how much wealth sits outside these mechanisms. Musk is worth just over $1 trillion, after SpaceX’s IPO last month made him the first person to reach that mark. Forbes counted 45 new AI billionaires in its 2026 rankings alone, worth a combined $2.9 trillion, and that’s before either Anthropic or OpenAI has gone public. In that same BI story about Anthropic employees, BI notes that once Anthropic and OpenAI complete their IPOs, their combined employees will hold enough wealth to buy nearly a third of all homes in the San Francisco metro area.

It feels unprecedented, but whether it represents an historic extreme is a matter of some debate. The share of wealth held by the top 1% of U.S. households hit 31.7% in the third quarter of last year, a record since the Federal Reserve began tracking the data in 1989, and roughly equal to what the other 90% of households outside the top decile held combined.

That’s still below the 45% the top 1% commanded at the Gilded Age peak in 1916. But narrow the lens to the tippy top, and the picture flips. Renowned economist Gabriel Zucman calculates that at the height of the Gilded Age, around 1910, America’s four largest fortunes were worth a combined 4% of U.S. GDP. Today, that same sliver of the population — now 19 households instead of four — is worth 14%.

Rimer’s two paths, voluntary or forced, have precedent from the last time American wealth concentration reached this level. In 1889, at the peak of the first Gilded Age, Andrew Carnegie published an essay arguing that a rich man should treat his fortune as a trust to be distributed for the public good within his own lifetime, calling it a disgrace to die wealthy. That essay, “The Gospel of Wealth,” became the founding document of modern philanthropy and the intellectual ancestor of the Giving Pledge.

It didn’t hold off the other path for long, though. By the mid-1930s, Louisiana Senator Huey Long had built a national following behind a program called Share Our Wealth, demanding steep taxes on the rich to fund a guaranteed income for every American. Worried about losing working-class support to Long, Franklin Roosevelt pushed through what the press called the “soak-the-rich tax,” raising the top marginal income tax rate as high as 79%. It redistributed less than Long wanted, but it remains the clearest example in American history of politically forced redistribution arriving once voluntary giving failed to adequately address the pressure building underneath it.

None of this is news to Rimer, who has spent his career in tech. What’s more curious to him is “the moral center of tech companies,” a fascination he traced to being a Stanford undergrad in 1984, when Apple discounted the first Macintosh for students and Steve Jobs and Apple’s other founders were, in his words, “heroes” for building something he felt was genuinely good for the world.

What troubles him now, he said, is hearing his own children talk about certain tech companies the way an earlier generation talked about defense contractors or cigarette makers.

Critics may note that Rimer — as an investor in Anthropic and other tech companies — is a direct beneficiary of the windfall he says will eventually need to be shared. But he’d rather see his fellow beneficiaries choose to give some of the money back than have it taken from them. There’s an easy way to do this and a hard way, and Rimer is betting on people picking the easy one before history picks it for them.

from the ctrl-alt-speech dept

Ctrl-Alt-Speech is a weekly podcast about the latest news in online speech, from Mike Masnick and Everything in Moderation‘s Ben Whitelaw.

Subscribe now on Apple Podcasts, Overcast, Spotify, Pocket Casts, YouTube, or your podcast app of choice — or go straight to the RSS feed. To get extended episodes with additional coverage, support us on Patreon.

In this week’s roundup of the latest news in online speech, content moderation and internet regulation, Ben is joined by Niklas Eder, co-founder and co-CEO of User Rights, a designated out of court dispute settlement body under the Digital Services Act which reviews complaints from users whose social media posts have been deleted or moderated. Together, Ben and Niklas discuss:

And in the extended episode for Patreon supporters, they cover:

Our fun links this week are a lawn mowing game for post-World Cup stress relief and the Center for the Alignment of AI Alignment Centers because we need more satire right now. 

This episode is sponsored by PwC, whose upcoming 2026 Trust and Safety Outlook Report explores the forces reshaping how organizations are approaching online safety and integrity. In our special bonus chat, Ben sits down with Dan Hays, Principal Partner of Strategy& (part of the PwC network), to talk about the future of trust and safety and get a sneak peek at some of the themes in their report before its release next week at TrustCon.

If you’re already a Patreon supporter, you can get the extended episode on Patreon.

Filed Under: child safety, content moderation, eu, immigration, social media, trust and safety, uk

Companies: discord, meta

Residential proxies are no longer treated as a simple anonymity tool in carding circles. They are increasingly discussed as one component of a broader identity-simulation stack, alongside device fingerprints, browser profiles, billing information, time zones, cookies, and transaction behavior.

To better understand how criminal actors currently use and evaluate this infrastructure, Flare researchers analyzed 2,889 unique underground posts published in the past two years across approximately 545 discussion threads. The conversations include operational guides, troubleshooting requests, provider comparisons, transaction-failure discussions, and advertisements for supposedly “clean” or finance-compatible proxy services. 

Together, they show that residential IP addresses remain important to carders but are no longer viewed as a reliable bypass on their own. Instead, actors repeatedly describe a market in which proxy pools become overused, addresses accumulate poor reputations, location data is inaccurate, and financial services block entire ranges. As a result, carders are becoming more selective, attempting to match IP geography with stolen identity data while combining proxies with antidetect browsers and other techniques designed to create a convincing digital identity.

The findings suggest that residential proxies remain a key part of the carding ecosystem, but also one of its increasingly fragile components.

Key points

• Carders increasingly judge a proxy by its history, not merely whether it belongs to a residential internet provider.

• Geographic consistency now extends beyond country matching to city, ZIP code, time zone, browser language, and billing information.

• Residential IPs are rarely considered sufficient alone and are frequently paired with antidetect browsers and fingerprint manipulation.

Advertisement

• Provider restrictions are creating a secondary market for supposedly “clean” residential IPs capable of reaching financial services.

• Defenders should treat residential traffic as context—not evidence that a user is legitimate.

What are residential proxies?

A residential proxy routes traffic through an IP address assigned by an internet service provider to a household or consumer device.

To a website, the connection may resemble that of an ordinary home user rather than traffic originating from a hosting provider or commercial VPN.

Residential proxies have legitimate uses, including localization testing, advertising verification, and brand protection.  Criminal actors value them because they can make fraudulent sessions appear closer to normal consumer traffic.

“Clean” has replaced “residential”

One of the clearest findings from the dataset is that carders no longer speak about residential proxies as a single trusted category. Instead, they divide them into “clean” and “dirty” pools.

A widely reposted underground guide titled “Getting the Cleanest Possible IPs for Carding” (see screenshot below) argues that even residential pools deteriorate as addresses are repeatedly used for abuse.

Another guide claimed that the important question was not simply whether an IP was residential, but whether it had previously been used against banks, payment processors, or other fraud-sensitive services.

This thinking also appears in troubleshooting discussions. Users compare fraud-score services, complain that the same address receives dramatically different reputational ratings, and report that an IP initially considered clean can become high-risk after a short period of activity.

The underlying assumption is significant: carders increasingly believe that proxy reputation is dynamic and influenced by every other customer using the same infrastructure.

Precision is moving from country to identity consistency

Older carding advice is often focused on selecting an IP in the same country as the stolen card. Recent posts describe a far narrower standard. 

A January 2026 thread about “geoconsistency” (see screenshot below) discussed matching an IP’s approximate location with the billing ZIP code, device time zone, operating-system language, and browser characteristics.

In another discussion, a user complained that major residential-proxy providers had removed ZIP-code targeting and now offered only country, state, and city selection.

The actor feared that city-level targeting would no longer provide enough precision to avoid fraud controls.

Not every technical claim made in underground forums is necessarily accurate. However, the discussions clearly demonstrate the actors’ operational mindset: they are trying to construct a coherent digital identity rather than merely concealing their real IP address.

The proxy is only one layer

The dataset repeatedly connects residential proxies with antidetection browsers, isolated devices, cookie history, WebRTC configuration, Canvas and WebGL fingerprints, and user-agent consistency.

One April 2026 guide warned that a “perfect residential proxy” would still fail if the browser profile exposed contradictory information. Another setup guide argued that copying a fixed configuration was ineffective because the device, proxy, account history, payment information, and target merchant must all be evaluated together.

This reflects the direction of modern fraud detection. Stripe’s documentation describes controls that combine transaction, identity, card, and historical signals rather than relying on one indicator. Its guidance on card testing also highlights velocity, repeated declines, inconsistent billing information, and the reuse of cards or customer details.

Carders are searching for finance-compatible IPs

Several posts complain that established proxy providers restrict access to banks, payment processors, government portals, and other fraud-sensitive services. This creates a practical problem for carders: an IP may appear residential and have a low fraud score yet still be unusable against the intended target.

Some actors interpret these restrictions as a sign that the provider is protecting its address pool from abuse. One widely circulated guide even suggested that restricted residential pools may contain cleaner IPs precisely because they have not been repeatedly used against financial institutions.

At the same time, the restrictions are creating demand for services advertised as “finance enabled,” “bank compatible,” or capable of accessing specific payment platforms.

Underground users exchange provider recommendations and methods for testing connectivity, although the reliability of these advertisements is difficult to verify and some may be scams.

This search for usable residential infrastructure is taking place within a much larger and increasingly contested proxy ecosystem. In July 2026, the FBI and industry partners seized hundreds of domains associated with the NetNut residential proxy platform and the Popa botnet.

Researchers connected the network to at least two million compromised devices, including smart TVs and streaming boxes, which were converted into residential proxy nodes.

The infrastructure was reportedly used for activities including advertising fraud, account takeover, and other abusive traffic.

A March 2026 FBI alert further warned that criminals can select residential proxy addresses down to the state and city level and specifically cited their use for account takeover, including matching an IP address to the victim’s city to reduce the likelihood of triggering a bank’s geolocation controls.

Together, the underground discussions and recent disruptions show why carders increasingly distinguish between merely obtaining a residential address and obtaining one that is sufficiently clean, precisely located, and permitted to interact with financial services.

What defenders can take

Residential IP addresses should not be treated as inherently trustworthy. The stronger signal is consistency across the entire session: device history, account age, browser fingerprint, payment instrument, billing information, transaction velocity, and behavior after checkout.

Organizations should also look for patterns that proxies do not easily conceal, including repeated identity creation, multiple cards connected to similar devices, abrupt geography changes, mismatched time zones, and clusters of low-value authorization attempts.

The underground discussions suggest that defenders are already raising the cost of fraud. Carders are spending more time searching for uncontaminated infrastructure, debating conflicting reputation scores, and trying to align increasingly granular identity signals.

Residential proxies remain valuable to carders, but they are no longer a universal bypass. Their effectiveness increasingly depends on the credibility of everything surrounding them and that broader identity is a much harder challenge for cybercriminals.

Learn more by signing up for our free trial.

Sponsored and written by Flare.