Originally published on proxymint.

A residential proxy botnet rents out hijacked routers, TV boxes and phones as proxy exits. How devices get enrolled, the 2024-2026 cases, and how to check.

TL;DR

  • A residential proxy botnet rents out hijacked home devices as proxy exits. Routers, cameras, Android TV boxes and phones relay strangers' traffic, so the target sees a household IP and the owner never agreed.
  • Enrolment needs nothing unusual from the owner. Default passwords, old firmware, TV boxes sold with a backdoor, open debugging ports and pirated software account for most infections in the 2024-2026 cases.
  • Takedowns cut infrastructure, not the device pool. Lumen counted close to 60 million victim IPs in proxy botnets in July 2026, after the IPIDEA and SocksEscort actions.
  • Consent is the line between a botnet and a residential network. Both look the same on the wire; how devices joined and whether owners can leave decide which one a buyer is paying.

Key takeaways

  • Scan your own LAN for open ADB on port 5555. An Android TV box that answers there can be taken over and turned into an exit, and it can expose other devices on the same network.
  • Watch per-device traffic at idle. A box that uploads steadily overnight with the screen off is relaying something; factory reset it or remove it.
  • Defend with reputation plus behaviour, not blanket blocks. Residential proxy flags in IP feeds catch exits, and behaviour scoring spares real customers who share the same household or carrier IP.
  • Ask any residential provider two questions. How did the devices join the pool, and can their owners opt out? Then read which uses the terms ban and who handles abuse reports.

Read the full guide on proxymint, with the commands, tables and sources.