The danger here, of course, is that while these compromised devices are currently being monetized in a relatively benign way (other than bandwidth costs to the user, which to be sure can be nontrivial)… it would be naive to assume that there isn't a Command and Control capability that can assign less benign tasking - or can be compromised to do so.
This also puts some of the troubling reports that politicians were bringing phones into SCIFs into context…
On a server that used to get below 1k HTTP requests a day, I've had several cases of mass scraping from these botnets exceeding 100req/s. The web is getting harder and harder to use due to all the anti-bot mechanisms site operators had to put up.
A compromised device inside the White House network could presumably be doing something _much_ worse than participating in a DDOS against random websites.
Perhaps some of them annoyed the President's illegally-appointed mega-donor, if they spoke out against giving root access to all his unvetted junior flunkies.
The same junior flunkies who would do things like go to government agencies, create administrative accounts, which would then, often with minutes, be seen connecting from Russia and Eastern Europe with the correct credentials.
Or let me sum it up for you. The government doesn't have the money to employ top security experts and top security experts don't actually want to work for the government.
Sometimes, top security experts often can’t work for the U.S. government even if they do want to due to being ineligible for security clearance from checks notes gender and sexuality mistrust, non-zero drug usage lifetime to date, formerly grayhats, have ever sought mental health care, and/or anti-authoritarian viewpoints.
I have T-mobile 5g. My IP shows up as a residential proxy. I can't control the T-Mobile 5g device. It's a black-box. And, I only have one Linux desktop on the home network (so no Windows/Mac malware).
Not sure why my IP is listed as a residential proxy.
There’s only that many ipv4 addresses and I believe all 5G are shared ones. That’s why they’re among the most valuable ip ranges for scraping. You can’t just naively ban that IP or you’ll ban a large group of users
Not sure about US but where I live I can manually set the access point of my phones mobile network and it gives me a unique ipv4 (new one each time in fact)
Neat. I almost said "surely this will only detect if your internet connection is itself being routed through a residential proxy", and then I realised that's effectively the same thing!
It detects if your IP is a residential proxy, not if you are using a residential proxy. From the perspective of the outside Internet, they are the same thing, the only one who cares about the difference is you.
My most worrisome IoT device I have on my network is a digital picture frame my wife connected, but I was surprised the company routinely updates it even though it's on Android 6 (!).
Step one, find your public IP, I like ipinfo.io but there are many other services that will show it. Then pop it into a tool like the one that's hosting TFA[1]
Unexpected traffic would be the biggest gross red flag. If it constrains itself to moving traffic when it's otherwise perform its desired function (if it's one of those "free TV" boxes and it only proxies when you're playing video) it might be hard to tease-out the unwanted traffic purely looking at bytes in/out.
Beyond that gross metric you're getting into capturing traffic and decoding it.
Check network traffic from smart devices would be a good start. If your TV does gigabytes of traffic in the night when you don’t use it, it most likely is acting as a residential proxy.
It's described at a high level in media often. Here's more detail though:
Person buys a product, or downloads some software - that unknowing to them, was reaching out to a central server elsewhere to establish a network tunnel. And over that tunnel, the other server routes traffic onto that person's home network. Which can then of course go onto the internet, and it appears like the traffic originated from their home internet connection.
Other people rent access to this network. The goal being, you have surreptitious access to appear as any one of tens of thousands of home network IP addresses on the public internet. Bad guys can use this to rotate through many different IP addresses when their access gets blocked because of malicious (or benign but unwanted) behavior on the internet. Residential IP addresses are more 'valuable' because they don't have the negative connotation that datacentre and commercial IPs can have, and they can be spread geographically or across many ISPs.
A very common way for people being a part of these residential proxy networks is by buying dodgy streaming boxes, and also installing shady apps on TV app marketplaces.
This isn't a theoretical problem either. My employer's website was being hammered by residential proxies a month ago. It wasn't until we setup WAF captcha rules that they mostly subsided. It wasn't even the typical exploit scanner. I don't know what the purpose was but it was effectively a DDoS.
Some good answers in this thread. I had the same question but I'm still a tad confused:
* I initially thought this meant someone in the WH network was using commercial proxies to appear as if they were exiting from a different network (which would align with "some user is firing up a proxy on their phone to exit in a different location")
* But then the description of residential proxies seemed to align more with traffic hitting an endpoint in the White House, and _exiting_ from the network there. But this didn't explain the timing (why isn't it 24/7).
* Finally it sounds like some person, legitimately on the WH network, has a device (cell phone, TV, whatever) that, when activated, is proxying outside traffic into the WH network.
It means some networked devices in there are being remotely piloted to tunnel network traffic to somewhere else. This scenario usually happens with more "unprofessional" ISPs, which sell bandwidth from their networked clients for people in need of such services.
Such as ignoring web scraping countermeasures, and DDoS.
There are companies that provide proxy services for scraping services, and residential proxies route through consumer networks (like Comcast) which is flagged less than a datacenter IP.
Many questionable TV streaming boxes pretend to deliver you video, but in reality they are also piggy backing on your personal ISP to power those companies.
> Residential proxy services sell access to everyday devices, letting customers send traffic through them so it appears to come from that device's network.
There are services you can pay for such that you can route internet traffic thru a specific IP in a specific part of the world. People (usually unwillingly and unknowingly) run software that effectively makes them part of a giant botnet. A computer running in Romania might have some kind of weather application or gambling/casino app that I could use to make an HTTP request as if I were on their network. So if you need access to 1,000 or 10,000 IP's to circumvent rate limits or perform crawling tasks, this is how you could do it.
I mean supply chain-attacks are everywhere. Smart-TV's with certain marketplace apps, IoT devices. Also, I'm surprised the white house's network is not monitored more.
Seems like the president found a business opportunity and gave internal orders to rent out the network infrastructure to 'ethically sourced' providers :^) Jokes aside, might be some infected IoT crap.
There are providers who claim they are ethically sourced, and that users have consented. Although I guess many are users who don't know or care that it is happening.
Ethically, if someone just wants to play a free game and doesn't care about it, is it okay? How knowledgable does a user have to be in order to have informed consent?
> There are providers who claim they are ethically sourced, and that users have consented. Although I guess many are users who don't know or care that it is happening.
Betcha that means there was "consent" language on page 55 of some click-through EULA.
There exist services that will pay you a fraction of money to host their residential proxy service on a computer you own. But I do think the majority of residential proxies are hijacked.
And making DDoS-attacks nigh impossible to IP block.
Residential proxies are in many cases at least shady, both on the side of who uses them and for what and on providers that are often not above using dark pattern to hide them in some innocuous app for a smart-whatever that silently runs a proxy on a unaware user's connection. And in many places in the world if illegal stuff in done using your connection you are liable, regardless if you knew about it.
I wouldn't call turning on CloudFlare's bot blocker an "absurd amount of effort" from the perspective of site owners.
But getting around it sure is annoying, sometimes I get flagged IP's from Comcast and can't visit sites like costco.com despite not doing any questionable stuff on my network.
Residential proxies are a very important part of the internet
So important that we have to trick people into using them. Remember when folks were running SETI@Home? Of course you do, because it was widely thought to be a good thing, and folks willingly signed up.
How many would buy the "box" if the advertising were honest about what's actually in the box?
Most tools can be dual-use. Residential proxies are also used by malevolent actors to hack infrastructure or financial institutions and let some other poor soul get investigated for it. This is why we can't have nice things.
True, though unfortunately people can not be trusted to declare their intentions so the residential proxies will ultimately have to be sacrificed and given they are fairly easy to identify by behavior I could foresee the feds now having a reason to round 'em up faster. They already took out NetNut, IPIDEA, SocksEscort, Doppellganger and the "Kim Wolf" Offshoots.
Some of the more legit providers have KYC in place, and do literally require you to declare you intentions to open an account, and block certain traffic proactively unless you can prove a legitimate use.
They list the IP addresses of all the residential proxies? Is there a link to the netsets of all the IPv4 addresses they are using I can download once a day? (preferably over rsync but git over https is fine too)
I don't think even the most "ethical" providers are going to volunteer that information, since that defeats the entire purpose of having a residential proxy in the first place.
Virtually all of it is the product of malware. This is like you saying that robbery is very important because you like buying cheap tools at pawnshops.
This also puts some of the troubling reports that politicians were bringing phones into SCIFs into context…
On a server that used to get below 1k HTTP requests a day, I've had several cases of mass scraping from these botnets exceeding 100req/s. The web is getting harder and harder to use due to all the anti-bot mechanisms site operators had to put up.
How is DDOSing every site on the web benign?
A compromised device inside the White House network could presumably be doing something _much_ worse than participating in a DDOS against random websites.
If something is on their network, they know about it. They have a bigger budget and more bodies to throw at the problem than you want to believe.
https://techcrunch.com/2025/03/11/doge-axes-cisa-red-team-st...
Perhaps some of them annoyed the President's illegally-appointed mega-donor, if they spoke out against giving root access to all his unvetted junior flunkies.
Or let me sum it up for you. The government doesn't have the money to employ top security experts and top security experts don't actually want to work for the government.
I mean politicians are so addicted to twitter the nsa makes special phones…
There is no evidence that physically ties this to the WH. It could be in a security lab for all they know. Or a guest network for the news media.
They don't need to be physically inside that building to be a network security problem.
Not sure why my IP is listed as a residential proxy.
https://darknetdiaries.com/episode/172/
There's a transcript if you want to read, not listen. At the start, you'll be "hey! I gotta get me one!" and later you'll be like "burn it with fire!"
If there's anything there, monitor your network to figure out exactly what
I was aghast when my partner connected a pet watering bowl to the WiFi.
https://support.frameo.com/hc/en-us/articles/23433637149842-...
1: https://layer3intel.com/context
Beyond that gross metric you're getting into capturing traffic and decoding it.
Person buys a product, or downloads some software - that unknowing to them, was reaching out to a central server elsewhere to establish a network tunnel. And over that tunnel, the other server routes traffic onto that person's home network. Which can then of course go onto the internet, and it appears like the traffic originated from their home internet connection.
Other people rent access to this network. The goal being, you have surreptitious access to appear as any one of tens of thousands of home network IP addresses on the public internet. Bad guys can use this to rotate through many different IP addresses when their access gets blocked because of malicious (or benign but unwanted) behavior on the internet. Residential IP addresses are more 'valuable' because they don't have the negative connotation that datacentre and commercial IPs can have, and they can be spread geographically or across many ISPs.
A very common way for people being a part of these residential proxy networks is by buying dodgy streaming boxes, and also installing shady apps on TV app marketplaces.
* I initially thought this meant someone in the WH network was using commercial proxies to appear as if they were exiting from a different network (which would align with "some user is firing up a proxy on their phone to exit in a different location")
* But then the description of residential proxies seemed to align more with traffic hitting an endpoint in the White House, and _exiting_ from the network there. But this didn't explain the timing (why isn't it 24/7).
* Finally it sounds like some person, legitimately on the WH network, has a device (cell phone, TV, whatever) that, when activated, is proxying outside traffic into the WH network.
Such as ignoring web scraping countermeasures, and DDoS.
Many questionable TV streaming boxes pretend to deliver you video, but in reality they are also piggy backing on your personal ISP to power those companies.
+ Sketchy Apps
+ Malware
+ Weird Android Variants
[0]: https://layer3intel.com/what-is-a-residential-proxy
> Residential proxy services sell access to everyday devices, letting customers send traffic through them so it appears to come from that device's network.
https://lieu.house.gov/media-center/in-the-news/what-can-we-...
Let me guess. The SDK being used does properly handle this and this whole article is anti residential proxy FUD.
I buy and use residential proxies, though.
While they have grown a bit too much, they are a natural response to the absurd amount of effort every website is pouring into anti-scraping tech.
Aren't they almost always run unknowingly, by people tricked into running them?
Ethically, if someone just wants to play a free game and doesn't care about it, is it okay? How knowledgable does a user have to be in order to have informed consent?
Betcha that means there was "consent" language on page 55 of some click-through EULA.
Help me understand. As far as I'm aware, these residential proxies are almost always malware.
> and can be used for extra anonymity
Great, so you can conduct illegal transactions and have some unsuspecting grandma take the blame and have her front door kicked in?
Technically correct statement though
They didn't just connect a coffee pot to their WiFi one day.
e.g. https://packetstream.io/share-bandwidth/
Residential proxies are in many cases at least shady, both on the side of who uses them and for what and on providers that are often not above using dark pattern to hide them in some innocuous app for a smart-whatever that silently runs a proxy on a unaware user's connection. And in many places in the world if illegal stuff in done using your connection you are liable, regardless if you knew about it.
But getting around it sure is annoying, sometimes I get flagged IP's from Comcast and can't visit sites like costco.com despite not doing any questionable stuff on my network.
So important that we have to trick people into using them. Remember when folks were running SETI@Home? Of course you do, because it was widely thought to be a good thing, and folks willingly signed up.
How many would buy the "box" if the advertising were honest about what's actually in the box?
Maybe some people do not want to provide their entire website as free training material to [insert LLM lab here]?