Residential proxy botnets: how they work and how to spot one

A residential proxy botnet is a network of hijacked home routers, cameras, Android TV boxes and phones whose connections are rented out as proxy exits without their owners’ knowledge. A customer’s traffic leaves through someone’s living room, so the target sees a household IP on a consumer ISP. The owners notice only when their IP gets blocked or investigated.

A network admin wants to know whether a device on the LAN is carrying strangers’ traffic. A team that buys residential proxies for price monitoring or ad verification wants to know how that supply differs from what the FBI keeps seizing.

Both answers start in the same place: how a router or a TV box ends up as someone else’s exit, and what the six big cases of 2024-2026 showed about it.

What a residential proxy botnet is

A botnet is a set of devices that one operator controls without the owners’ consent. A proxy botnet uses that control for one job: relaying other people’s traffic. Each infected device opens an outbound connection to the operator’s servers and waits. When a customer of the proxy service sends a request, the operator picks a device in the right country and tells it to fetch the page.

Consent separates it from an ordinary residential proxy network; the technology is shared. The FBI’s public service announcement of 12 March 2026 says residential proxies get their addresses either from device owners who agreed, or from owners who did not and do not know. Only the second route is a botnet. Both produce the same traffic on the wire. For the legitimate model in full, see what a residential proxy is.

How devices get enrolled

Enrolment routes repeat across every case from the last three years. None of them needs the owner to do anything unusual.

Default credentials and old firmware. Routers, security cameras and video recorders with factory passwords or unpatched firmware are scanned and infected in bulk. The AVrecon malware behind SocksEscort targeted around 1,200 router and IoT models from brands including Cisco, D-Link, Mikrotik, NETGEAR, TP-Link and Zyxel, according to the US Attorney’s Office for the Eastern District of California (12 March 2026).

Devices sold already infected. The FBI’s BADBOX 2.0 announcement of 5 June 2025 describes streaming boxes, projectors and infotainment units that ship with a backdoor, or install one during setup by pulling apps from unofficial marketplaces.

Exposed debugging ports. Many cheap Android TV boxes ship with Android Debug Bridge (ADB) listening on TCP port 5555 with no authentication, and anyone who reaches that port gets a superuser shell. Synthient found about two thirds of the devices in the Kimwolf botnet in that state.

Pirated software and undisclosed apps. The FBI PSA lists malware hidden in free pirated games and video, and free VPN apps whose terms bury the fact that the phone becomes an exit. Apps that share the connection without a clear consent screen belong in the same group.

How the proxy traffic flows

Google’s Threat Intelligence Group (28 January 2026) mapped the IPIDEA network as two tiers of command and control: a first tier where infected devices check in and register, and a second tier of roughly 7,400 servers that hand out proxy tasks.

A request takes four steps:

1. The proxy customer connects to a gateway (often called backconnect) and asks for an exit in a country or city.
2. The gateway picks a registered device in that location.
3. The device already holds an open connection outward to a tasking server, so no inbound port on the victim’s router is needed.
4. The device opens a fresh TCP connection to the target and relays bytes both ways.

Step 4 matters for detection. The target’s TCP connection ends at the infected device, so the target sees the victim’s IP, the victim’s ISP and ASN, and the TCP/IP fingerprint of a Linux-based router or an Android box. Layer by layer, how websites detect proxies shows which of those signals the client controls and which the exit controls.

Why it reaches the home network

Kimwolf added a second problem. Researchers at Synthient found its operators tunnelling through residential proxy exits back into the private networks behind them, using DNS records that resolve to addresses like 192.168.0.1, then running adb connect against TV boxes on the same LAN. KrebsOnSecurity reported the technique on 2 January 2026. A device behind a home router is not protected just because it is behind the router, if something else on that network is an exit.

Major residential proxy botnet cases

Six cases between 2024 and 2026 show the pattern: law enforcement and platforms take down infrastructure, and the device pool regrows elsewhere.

The Aisuru shift came from KrebsOnSecurity in October 2025. The 911 S5 figures come from the Department of Justice (29 May 2024).

Takedowns do not shrink the total for long. Lumen’s Black Lotus Labs, reported by CyberScoop on 24 July 2026, counts close to 60 million victim IP addresses across more than 30 proxy botnet clusters, and says IPIDEA’s pool recovered to about 10 million IPs after the January disruption.

What the exits get used for

Proxy botnet customers pay to look like a household. Google’s IPIDEA report lists access to SaaS environments and password spraying by groups linked to China, North Korea, Iran and Russia. The FBI and its partners tied SocksEscort to ad fraud, password spraying, banking and marketplace fraud, and attempts to exploit websites. Krebs reports that aggressive scraping done for AI companies now runs through these networks because household IPs make the traffic harder to filter out. The same devices also flood targets: Nokia Deepfield and Comcast’s threat research lab reported in a NANOG97 talk in June 2026 that daily active DDoS botnet endpoints climbed from roughly 1 million in summer 2025 to over 8 million.

The device owner carries the cost. Their IP collects the abuse history, so their own logins hit captchas, their streaming service flags them, and in fraud cases investigators knock on the wrong door first.

Signs a device is enrolled

No single check proves infection, but four are cheap and catch most cases. Run them only on a network you own or administer.

Unknown or off-brand devices. List everything on the router’s DHCP table. An Android TV box from an unknown brand, bought because it promised free channels, is the highest-risk device in most homes. Google’s July 2026 guidance is to check that Android TV devices are Play Protect certified.

Traffic at idle. A TV box that uploads steadily at 3 a.m. with the screen off is relaying something. Most routers show per-device traffic; a short capture on a mirrored port shows the destinations.

Open ADB on the LAN. This scan lists devices that answer on the ADB port:

# Scan your own LAN for Android Debug Bridge on TCP 5555
nmap -p 5555 --open 192.168.1.0/24

Any hit on a consumer device is worth a factory reset and a firmware check, or removal.

Your public IP has a reputation. Look up the home IP in an IP-intelligence service. A household address flagged as a proxy exit, while nobody in the house runs one, points to a device that does.

Then fix the basics: change default router passwords, update or replace end-of-life routers, remove apps that share the connection without having asked, and keep IoT devices on a separate network segment.

How websites and ISPs detect it

A website only ever sees the exit. Detection works on what that exit gives away, and the ISP carrying it sees a second side.

IP reputation. Feeds now label residential exits directly. MaxMind’s Anonymous IP database documentation describes an is_residential_proxy flag, and Google’s January 2026 report tells enterprises to monitor IP reputation for residential proxy exit nodes.

Behaviour. Cloudflare described a machine learning model for residential proxy abuse on 24 June 2024 that scores request patterns instead of blocking IP ranges. One household IP can carry a real customer and a bot within the same hour.

Cross-layer mismatches. An exit on a router’s Linux TCP stack carrying a Windows browser User-Agent, or round-trip times that disagree between the TCP and TLS layers, mark relayed traffic.

Network operators. ISPs see the other end. An infected box on a subscriber line opens long-lived outbound connections to tasking servers and, when the botnet turns to DDoS, sends floods from inside the provider’s own network. Flow monitoring on subscriber traffic, sinkholing known command domains and notifying the customer close the loop.

Blanket blocks backfire. Mobile carriers put many subscribers behind one address through CGNAT, and an infected TV box shares its IP with the family next to it. Rate limits and step-up checks on suspicious sessions hurt fewer real customers than blocking a whole consumer ASN.

Botnet vs consented residential networks

A buyer of residential proxies needs a test that does not depend on marketing copy. The difference shows up in six places.

Two questions settle most of it: how did the devices join the pool, and can their owners leave? Then read the terms for the uses they ban, and find the abuse contact. proxymint’s answers: its residential exits come from device owners who opted in and can opt out, its terms ban fraud, credential stuffing, unauthorised account access and the other uses the FBI lists, and it acts on abuse reports. For what those bans look like across the market, see the guide to a proxy acceptable use policy.

For the jobs residential exits are built for, such as price and stock monitoring across markets, local search tracking where the engine permits it, and ad verification on home networks, rotating residential proxies carry the traffic through a home connection with country, region and city targeting.

When are residential proxies legal?

Residential proxies are legal to buy and use in most jurisdictions. Running a residential proxy botnet is not: infecting devices and selling access to them are crimes in every case above, which is why administrators were arrested and domains seized.

Two things decide a given case: how the IPs were obtained, and what the traffic does. A consented pool used for public price monitoring is a different act from a botnet used for password spraying. Buying from a botnet operator knowingly can expose the buyer too. This is general information, not legal advice.

What to do next

If you run a home or small-office network, scan for open ADB, check idle traffic per device, and replace any off-brand TV box or end-of-life router you cannot update. If you defend a website, combine IP reputation with behaviour scoring and avoid blanket blocks on consumer ASNs. If you buy residential proxies, ask how the devices joined and whether owners can leave; those two answers separate a consented pool from a residential proxy botnet. Then read the banned-use list and keep your own traffic inside it.