A residential proxy botnet is a pool of home and small-office devices that relay other people's traffic without their owners agreeing, sold as residential exits. Public research has traced such pools to hijacked servers, to legitimate bandwidth-sharing kits installed by intruders, and to cheap TV boxes that ship with proxy code inside. So "residential" tells you what an address looks like. It tells you nothing about how the seller came to have it.
What "residential" means on a seller's page
A residential exit is an address in a consumer ISP's range: a home broadband line, a phone on a mobile network. That is the whole definition, and it is why the product sells. A site sees an ordinary household, not a datacentre. Our residential proxy entry covers how sessions on those pools work.
A seller can get those addresses in roughly three ways. It can pay people to run an app that shares their spare bandwidth, with the owner knowing. It can pay app developers to put a proxy SDK inside their free apps, and then the owner's consent is a line in a licence they did not read. Or it can buy access to devices nobody agreed to share at all. On the seller's dashboard all three produce the same thing, a list of exits with country and city tags.
Paste one gateway line. Every profile mints its own exitIn Mosaic: Provider minting. One gateway line, a separate exit for every profile. Free holds 3 profiles. Pro is $49 a month for any number.
Mosaic is a desktop app
Email yourself the link and open it on your computer.
How it works: Provider minting
What researchers have found in residential proxy botnets
Three published investigations show how wide the third category is.
Palo Alto Networks' Unit 42 described a campaign that exploited CVE-2024-36401, a remote code execution flaw in GeoServer, and then installed real bandwidth-sharing software on the machines it broke into. The software was not malware. It was the same kind of kit people install on purpose to earn a little from idle bandwidth, except that the earnings went to the intruder. Unit 42 called it "Your Connection, Their Cash".
Google's Threat Intelligence Group wrote up IPIDEA, a network that enrolled devices through proxy SDKs. App developers were paid to include them, Windows programs posed as familiar system tools while carrying them, and some uncertified Android TV boxes left the factory with the proxy payload already installed. Google tied the same infrastructure to earlier botnet campaigns.
And Brian Krebs has reported on the Aisuru botnet's operators reworking their malware so infected devices could be rented out to residential proxy services.
None of these shows what any particular seller does. Together they show that infected or tricked devices are a supply line for residential pools, and that the line can run through software that looks entirely legitimate.
Why the buyer cannot see it
An infected router and a consenting volunteer's laptop leave the same trace. Both sit on a home connection, both have an ISP's name in their reverse DNS, and both answer a proxy check the same way. No test run from the buyer's side separates them, because the difference is in a decision the device's owner did or did not make.
What can be measured is an address's history. Mosaic's exit reputation check asks public DNS blocklists about the exit: SpamCop, Barracuda, SORBS, s5h, AnonMails and UCEPROTECT. It also reads the network type from the geo lookup and looks for a hosting provider's name in the PTR record. SORBS has return codes for an open HTTP proxy, an open SOCKS proxy and a hijacked network range, which are exactly the kinds of address a botnet produces.
A listing is a fact about what an address was seen doing. A clean result is not a certificate of consent, and a listing is not proof of infection: SORBS also lists ordinary dynamic ranges, which we explained in a SORBS dynamic-range listing. Spamhaus is left out on purpose, because it returns an error code to open resolvers and a check run from a desktop would get a confident wrong answer (why Spamhaus refuses public resolvers).
What it means if you buy residential proxies
The first cost lands on somebody else. Traffic for your client's account goes out through a stranger's connection, and if that stranger never agreed, you are using something taken from them.
The second cost is yours. Exits that share a device with abuse are the ones that end up on lists and get treated as proxies by the sites you log in to, which is one route to the problem in a residential IP detected as a proxy.
Mosaic reads the line formats of dozens of proxy sellers so that each profile can mint its own session from one pasted gateway line. That table is a grammar, not an endorsement. We have not audited any seller's sourcing and do not claim to. Ask the seller how devices join its pool, what their owners are told and paid, and whether its SDK runs inside other companies' apps. What a seller can see of your traffic once it carries it is a separate question, answered in what a proxy provider can see.
