# Residential proxy botnets: where the exits come from > Research has traced residential proxy pools to hijacked servers, paid SDKs and TV boxes sold with proxy code. Residential describes an address, not its source. Source: https://mosaicbrowser.com/blog/residential-proxy-botnets ## When the residential exit is somebody's infected router Research has traced residential proxy pools to hijacked servers, paid SDKs and TV boxes sold with proxy code. Residential describes an address, not its source. ![Residential says what an address looks like, beside a screenshot: a proxy check result in Mosaic: latency, exit address, ISP, HTTPS tunnelling and reputation](https://mosaicbrowser.com/covers/residential-proxy-botnets.webp) A residential proxy botnet is a pool of home and small-office devices that relay other people's traffic without their owners agreeing, sold as residential exits. Public research has traced such pools to hijacked servers, to legitimate bandwidth-sharing kits installed by intruders, and to cheap TV boxes that ship with proxy code inside. So "residential" tells you what an address looks like. It tells you nothing about how the seller came to have it. ## What "residential" means on a seller's page A residential exit is an address in a consumer ISP's range: a home broadband line, a phone on a mobile network. That is the whole definition, and it is why the product sells. A site sees an ordinary household, not a datacentre. Our [residential proxy](https://mosaicbrowser.com/glossary/residential-proxy) entry covers how sessions on those pools work. A seller can get those addresses in roughly three ways. It can pay people to run an app that shares their spare bandwidth, with the owner knowing. It can pay app developers to put a proxy SDK inside their free apps, and then the owner's consent is a line in a licence they did not read. Or it can buy access to devices nobody agreed to share at all. On the seller's dashboard all three produce the same thing, a list of exits with country and city tags. Mosaic is a desktop app Email yourself the link and open it on your computer. [How it works: Provider minting](https://mosaicbrowser.com/features/proxy-providers) ## What researchers have found in residential proxy botnets Three published investigations show how wide the third category is. Palo Alto Networks' Unit 42 described a campaign that exploited CVE-2024-36401, a remote code execution flaw in GeoServer, and then installed real bandwidth-sharing software on the machines it broke into. The software was not malware. It was the same kind of kit people install on purpose to earn a little from idle bandwidth, except that the earnings went to the intruder. Unit 42 called it "Your Connection, Their Cash". Google's Threat Intelligence Group wrote up IPIDEA, a network that enrolled devices through proxy SDKs. App developers were paid to include them, Windows programs posed as familiar system tools while carrying them, and some uncertified Android TV boxes left the factory with the proxy payload already installed. Google tied the same infrastructure to earlier botnet campaigns. And Brian Krebs has reported on the Aisuru botnet's operators reworking their malware so infected devices could be rented out to residential proxy services. None of these shows what any particular seller does. Together they show that infected or tricked devices are a supply line for residential pools, and that the line can run through software that looks entirely legitimate. ## Why the buyer cannot see it An infected router and a consenting volunteer's laptop leave the same trace. Both sit on a home connection, both have an ISP's name in their reverse DNS, and both answer a proxy check the same way. No test run from the buyer's side separates them, because the difference is in a decision the device's owner did or did not make. What can be measured is an address's history. Mosaic's exit reputation check asks public DNS blocklists about the exit: SpamCop, Barracuda, SORBS, s5h, AnonMails and UCEPROTECT. It also reads the network type from the geo lookup and looks for a hosting provider's name in the PTR record. SORBS has return codes for an open HTTP proxy, an open SOCKS proxy and a hijacked network range, which are exactly the kinds of address a botnet produces. ![A proxy check in Mosaic, with the exit's address, ISP, HTTPS tunnel and reputation](https://mosaicbrowser.com/shots/proxy-check.png) *The reputation half of a proxy check reads blocklists, network type and rDNS* A listing is a fact about what an address was seen doing. A clean result is not a certificate of consent, and a listing is not proof of infection: SORBS also lists ordinary dynamic ranges, which we explained in [a SORBS dynamic-range listing](https://mosaicbrowser.com/blog/sorbs-dynamic-range-listing). Spamhaus is left out on purpose, because it returns an error code to open resolvers and a check run from a desktop would get a confident wrong answer ([why Spamhaus refuses public resolvers](https://mosaicbrowser.com/blog/spamhaus-public-resolver)). ## What it means if you buy residential proxies The first cost lands on somebody else. Traffic for your client's account goes out through a stranger's connection, and if that stranger never agreed, you are using something taken from them. The second cost is yours. Exits that share a device with abuse are the ones that end up on lists and get treated as proxies by the sites you log in to, which is one route to the problem in [a residential IP detected as a proxy](https://mosaicbrowser.com/blog/residential-ip-detected-as-proxy). Mosaic reads the line formats of dozens of proxy sellers so that each profile can mint its own session from one pasted gateway line. That table is a grammar, not an endorsement. We have not audited any seller's sourcing and do not claim to. Ask the seller how devices join its pool, what their owners are told and paid, and whether its SDK runs inside other companies' apps. What a seller can see of your traffic once it carries it is a separate question, answered in [what a proxy provider can see](https://mosaicbrowser.com/blog/what-a-proxy-provider-can-see). ## Questions ### What is a residential proxy botnet? A set of devices that relay strangers' traffic without their owners agreeing to it, sold as residential exits. The device may be infected with malware, or it may run a real bandwidth-sharing app installed by somebody who broke in. ### Can I tell whether a residential exit comes from an infected device? Not from the address. An exit on a home connection reads as residential whether its owner signed up to share bandwidth or never knew. Blocklists record what an address has been seen doing; they do not record consent. ### Does Mosaic vet the proxy sellers it supports? No. Mosaic's vendor table records how each seller writes its gateway line, so a profile can mint its own session. Being in the table says nothing about where a seller's exits come from. ### What should I ask a proxy seller about sourcing? How devices join the pool, what the owner is told and paid, and whether the seller's SDK runs inside other companies' apps. Then judge the answer for yourself. ## Related [Residential proxy: an exit on a home internet connection](https://mosaicbrowser.com/glossary/residential-proxy): A residential proxy sends your traffic out through an address an ISP assigned to a home connection, so sites see a household rather than a data center. [What your proxy provider can and cannot see](https://mosaicbrowser.com/blog/what-a-proxy-provider-can-see): Over HTTPS a proxy provider sees each hostname, port, time and byte count, never the pages or passwords. Over plain HTTP it sees everything you send. [A blocklist that lists home connections for being home](https://mosaicbrowser.com/blog/sorbs-dynamic-range-listing): SORBS answered 127.0.0.10 when an IP sat in a home ISP's range, so a residential proxy got listed for being residential. Read the code first. [Why our reputation check doesn't ask Spamhaus](https://mosaicbrowser.com/blog/spamhaus-public-resolver): Spamhaus refuses queries that arrive through public resolvers, so asking it from an ordinary computer returns a confident wrong answer. We left it out instead. [The residential IP several detectors already knew](https://mosaicbrowser.com/blog/residential-ip-detected-as-proxy): A residential proxy can be detected as a proxy because it is one. On one Wichita exit, FingerprintJS and incolumitas never loaded in three rounds. [Detecting a proxy with two clocks](https://mosaicbrowser.com/blog/proxy-detection-by-latency): A server times the TCP handshake to the exit and a round trip to the browser. Behind a proxy the second is longer, and the gap is the tunnel. ["Unlimited bandwidth" proxies and where the limit really is](https://mosaicbrowser.com/blog/unlimited-bandwidth-proxies): An unlimited bandwidth residential proxy still has a limit. It moves to threads, ports, speed or a fair-use clause, and the terms say which one. [The proxy bill is usually bigger than the browser bill](https://mosaicbrowser.com/blog/proxy-bill-bigger-than-browser): Past a couple of dozen profiles, the exits cost more each month than the anti-detect browser. That is why we price per month, not per profile. ## Mosaic, on your own computer The browser this blog is about: its own Chromium, fingerprints from real machines and a proxy exit per profile. Free holds 3 profiles. Pro is $49 a month for any number. Mosaic is a desktop app Email yourself the link and open it on your computer.