Residential proxies detected on White House network (layer3intel.com)

485 pointsby Rasbora3 hours ago142 comments

dhosek 32 minutes ago

They’re too polite to say it explicitly, but when they say:

> Most of the activity happens in the evening, Eastern time: about half of it falls between 5 p.m. and midnight, and almost none happens in the early morning. That pattern suggests a person rather than a public guest Wi-Fi network: someone regularly on the White House network late into the evening, whose device is infected with a proxy SDK. Our data shows the exits, not the device or the person behind them.

There really aren’t very many candidates for who that person might be and it really seems like it would be someone who, I don’t know, maybe lives where the traffic is originating.

dpark 15 minutes ago

A lot of people work at the White House. Many of them doubtless work a night shift. The set of candidates here is actually quite large.

therein 8 minutes ago

Could even be cleaning or security.

dpark 5 minutes ago

As someone elsewhere in the thread noted, this could well be the press. Could also be that this isn’t the White House network at all despite that attribution.

gcollard- 9 minutes ago

Or the cleaning or security staff working the night shift.

btown 2 hours ago

The danger here, of course, is that while these compromised devices are currently being monetized in a relatively benign way (other than bandwidth costs to the user, which to be sure can be nontrivial)… it would be naive to assume that there isn't a Command and Control capability that can assign less benign tasking - or can be compromised to do so.

This also puts some of the troubling reports that politicians were bringing phones into SCIFs into context…

lesuorac 2 hours ago

> This also puts some of the troubling reports that politicians were bringing phones into SCIFs into context…

I mean politicians are so addicted to twitter the nsa makes special phones…

dylan604 38 minutes ago

Not sure which direction you're intending this. The NSA is making special phones to protect politicians, or to make it easier to ensure they can read everything?

za_creature 34 minutes ago

Por que no los dos?

It's always better to protect politicians from someone else

lesuorac 22 minutes ago

Politicians bringing phones isn’t a scif isn’t necessarily a bad thing.

mzajc 2 hours ago

> benign

On a server that used to get below 1k HTTP requests a day, I've had several cases of mass scraping from these botnets exceeding 100req/s. The web is getting harder and harder to use due to all the anti-bot mechanisms site operators had to put up.

How is DDOSing every site on the web benign?

nucleardog 2 hours ago

Relatively benign.

A compromised device inside the White House network could presumably be doing something _much_ worse than participating in a DDOS against random websites.

lakeviewterrace 2 hours ago

Not really. The government employs better network security people than the average HN schizo detective.

If something is on their network, they know about it. They have a bigger budget and more bodies to throw at the problem than you want to believe.

hackernud3s 2 hours ago

Apparently they do not though.

Terr_ 2 hours ago

There were experts but the Republican White House fired them:

https://techcrunch.com/2025/03/11/doge-axes-cisa-red-team-st...

Perhaps some of them annoyed the President's illegally-appointed mega-donor, if they spoke out against giving root access to all his unvetted junior flunkies.

FireBeyond an hour ago

The same junior flunkies who would do things like go to government agencies, create administrative accounts, which would then, often with minutes, be seen connecting from Russia and Eastern Europe with the correct credentials.

trismus 40 minutes ago

Source?

adzm 18 minutes ago

> Daniel J. Berulis, a cybersecurity architect with the NLRB, filed a whistleblower complaint alleging that within 15 minutes of DOGE team members creating new user credentials and demanding administrative access, multiple login attempts using those exact credentials originated from a Russian IP address

https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-...

Terr_ 18 minutes ago

Oh come on, search-engines have gone downhill, but not that far downhill! You already know it involves "DOGE" and "Russia" and "credentials", that ought to be enough:

* https://www.reuters.com/technology/cybersecurity/whistleblow...

* https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-...

2III7 2 hours ago

Read "This is how they tell me the world ends".

Or let me sum it up for you. The government doesn't have the money to employ top security experts and top security experts don't actually want to work for the government.

altairprime an hour ago

Sometimes, top security experts often can’t work for the U.S. government even if they do want to due to being ineligible for security clearance from checks notes gender and sexuality mistrust, non-zero drug usage lifetime to date, formerly grayhats, have ever sought mental health care, and/or anti-authoritarian viewpoints.

lakeviewterrace an hour ago

To be fair, the track record for mentally unwell people in positions of trust isn't great.

dylan604 40 minutes ago

Before the most recent elections, people voted for an unwell person to lead the country. So it's not just someone can obtain the position, but that people actually chose to put one in office. Twice. Although, it was less well known on the first one.

manyatoms 2 hours ago

I'd be stunned if they're paying anywhere near enough to attract top talent

vlan0 an hour ago

Th best folks I know wouldn't touch a government job, no matter the pay.

fhub 33 minutes ago

There was a period of time where it seemed (as an outsider) that they were attracting good talent. This was when Megan Smith was CTO. https://en.wikipedia.org/wiki/Megan_Smith.

alt227 an hour ago

Dont they usually bargain work against jailtime for domestic cyber criminals?

dhosek an hour ago

I applied to USDS in 2023, the process took nearly a year and ended with them just ghosting me after two interview rounds. Pay was capped (by law) below my target salary but at a level that I would accept as it would have been fully remote, but there was also a term limit on the job which meant I would have at most two years in the position.

It’s not just the pay, there’s a lot of structural elements that mean that the potential talent pool is less than desired.

vlan0 an hour ago

Bruh do you remember snowden? The government is HEAVILY sub-contracted. Accenture? Really? My guy...

cyanydeez 25 minutes ago

Compared to, russian intel scraping beyond demented word of mouth.

BeetleB 11 minutes ago

> The web is getting harder and harder to use due to all the anti-bot mechanisms site operators had to put up.

Indeed. I recently set up a bot on my local machine that I can interact with via Telegram. I gave it the ability to retrieve the contents of a URL via Playwright (with modifications). Basic things like getting the Readability view and getting the site as Markdown with links.

I was essentially mimicking the feature OpenAI etc offer where it can do a web search for you and get you the answer you seek. I just didn't want to pay a company for that feature.

It's not autonomous. It only acts when I tell it to. The actual search is via the Kagi API, but the URL contents is via Playwright. I also ensured it can't do lots of requests at a time. There's a mandatory (random) sleep of between 1 and 5 seconds between two requests.

In less than a week, I've been flagged. When I do a Google search (as a human), I have to prove I'm human. Many sites have simply blocked me - I can't buy stuff from various vendors[1], I cannot access several news sites, etc.

The thing is, I didn't really access that many sites with the bot! At most it's the equivalent of someone mildly addicted to the web. Yet they caught me quickly.

Obviously, I disabled the bot's capability to get site content. I wonder how long my IP will be in the blacklist.

I know some people will say "Good riddance" to the outcome and to what I did. I'd love to have a real, serious discussion on whether what I did was immoral. But whatever your thoughts on the matter, do ponder over the fact that the system has made it hard for average Joes like you and me to have this "feature", but if you pay a giant tech company a monthly fee, you can have it.

[1] Thankfully, Amazon didn't block me. In the past I'd avoid them, but now I'm in the dilemma where I don't want to buy stuff from sites that make it difficult for me to buy stuff from them!

_alternator_ 10 minutes ago

I'll just note that "compromised" is perhaps too strong. These services often come from VPN plugins (eg Hola VPN) that lets users watch sports from different restricted geographic regions. There is a trade here that's in the TOs: you get someone else's IP address, they get yours.

lakeviewterrace 2 hours ago

So they don't actually know what this network is, just who owns the IP space... time for a blog post to advertise our week-old service!

There is no evidence that physically ties this to the WH. It could be in a security lab for all they know. Or a guest network for the news media.

1e1a 2 hours ago

Perhaps ping time measurements could help identify where the devices are physically located.

0cf8612b2e1e 18 minutes ago

If you were really sneaky, could you add some small jitter to the network responses to make it more difficult to locate?

Terr_ an hour ago

> There is no evidence that physically ties this to the WH.

They don't need to be physically inside a specific building to be a networking security problem.

The core issue is whether an outsider has bypassed your firewall and can send+receive traffic from a node which is getting more trust than it deserves. If they've compromised the computer's microphone/camera/wifi-control that's an additional problem.

lakeviewterrace 26 minutes ago

If only the entire resources of the US federal government had access to this critical cybersecurity knowledge known only to you.

bronco21016 3 hours ago

Gotta have your SuperBox set up to watch 24 hr cable news working late into the night.

thehodge 3 hours ago

That was the first thing I thought of!

JTbane 2 hours ago

I have seen these at mall kiosks advertising "free cable", and today I learned they are proxying from your home network.

Tangurena2 an hour ago

For those who don't know what this is, here's a decent podcast about it:

https://darknetdiaries.com/episode/172/

There's a transcript if you want to read, not listen. At the start, you'll be "hey! I gotta get me one!" and later you'll be like "burn it with fire!"

ethagnawl 41 minutes ago

A friend in Texas claims they recently bought one at Wal-Mart. I don't know anything about how these work but that can't be true ... right?

mplewis 34 minutes ago

It's absolutely true, these are sold all over the place

seethishat an hour ago

I have T-mobile 5g. My IP shows up as a residential proxy. I can't control the T-Mobile 5g device. It's a black-box. And, I only have one Linux desktop on the home network (so no Windows/Mac malware).

Not sure why my IP is listed as a residential proxy.

hetspookjee an hour ago

There’s only that many ipv4 addresses and I believe all 5G are shared ones. That’s why they’re among the most valuable ip ranges for scraping. You can’t just naively ban that IP or you’ll ban a large group of users

sva_ an hour ago

Not sure about US but where I live I can manually set the access point of my phones mobile network and it gives me a unique ipv4 (new one each time in fact)

BLKNSLVR an hour ago

You certainly can ban that IP.

It should be a balancing act though, somewhere between what you said and my first sentence.

Rate limiting, or additional layers of input sanitisation for IP addresses known to have been malicious in the past.

It's unfortunate that good users will have to endure some difficulties because of bad users on the same network, but if security is the priority, then measures must be taken, you shouldn't just leave to door open to potentially known bad users / traffic.

IPv4 is a shared resource, but some ranges have worse reputations than others, and all are owned by organisations that have the ability to monitor and filter for malicious traffic. It gets into a fraught discussion about censorship, but it is possible for network owners to monitor for, and block / restrict traffic detected as 'bad'. It's just a matter of cost and scale, and those that put the effort in should have their users rewarded with fewer 'trust-issues' roadblocks.

ofcrpls an hour ago

You might just be experiencing T-Mobile's CGNAT on mobile broadband?

walrus01 an hour ago

You're almost certainly behind a cgnat shared with a bunch of compromised/residential proxy running phones and other traffic.

hackernud3s 2 hours ago

Those are better than residential proxies. Those are White House proxies. I would pay $10/GB for those babies.

mrefish an hour ago

Executive residential proxies

BLKNSLVR an hour ago

Those proxies are paid for in rubles, not dollars.

j2kun 2 hours ago

Out of curiosity, how would I check my own device for a residential proxy?

Retr0id 2 hours ago

Watch egress at the router for anything unaccounted for, tbh.

0cf8612b2e1e 2 hours ago

Fantastic question. There is so much IOT garbage out there that someone might slip into my network, what can I do to easily detect it?

I was aghast when my partner connected a pet watering bowl to the WiFi.

doublepg23 2 hours ago

My most worrisome IoT device I have on my network is a digital picture frame my wife connected, but I was surprised the company routinely updates it even though it's on Android 6 (!).

https://support.frameo.com/hc/en-us/articles/23433637149842-...

randomblock1 2 hours ago

Scroll down to "anonymization": https://ipinfo.io/what-is-my-ip

If there's anything there, monitor your network to figure out exactly what

advisedwang an hour ago

AFAIU that tells you if your access to ipinfo.io is thru a residential proxy, not if somebody else is using a residential proxy on your network.

Retr0id an hour ago

It's effectively the same thing. If a residential proxy is running on your network, your IP will soon become known as a residential proxy exit.

nostrademons an hour ago

It detects if your IP is a residential proxy, not if you are using a residential proxy. From the perspective of the outside Internet, they are the same thing, the only one who cares about the difference is you.

Retr0id an hour ago

Neat. I almost said "surely this will only detect if your internet connection is itself being routed through a residential proxy", and then I realised that's effectively the same thing!

masfuerte an hour ago

It lists VPN, Proxy, Tor, etc. Presumably a minus sign in a circle means you don't have the thing?

beepbooptheory an hour ago

I had same confusion for a second but the html does clear it up: yes, it means you don't have the thing.

   <li class="...">
     <div class="...">
       <div class="..."></div>
     </div>
     <span class="text-sm">Residential Proxy</span>
     <span class="sr-only">Not detected</span>
   </li>

anpat 2 hours ago

How would one detect this on their home network and protect themselves from?

blacksmith_tb 2 hours ago

Step one, find your public IP, I like ipinfo.io but there are many other services that will show it. Then pop it into a tool like the one that's hosting TFA[1]

1: https://layer3intel.com/context

therein 5 minutes ago

There is also iphub.info and iphunter.info.

In my experience, out of the two, iphunter.info has the more comprehensive database, I think the owner/operator frequents HN.

tom1337 2 hours ago

Check network traffic from smart devices would be a good start. If your TV does gigabytes of traffic in the night when you don’t use it, it most likely is acting as a residential proxy.

EvanAnderson 2 hours ago

Unexpected traffic would be the biggest gross red flag. If it constrains itself to moving traffic when it's otherwise perform its desired function (if it's one of those "free TV" boxes and it only proxies when you're playing video) it might be hard to tease-out the unwanted traffic purely looking at bytes in/out.

Beyond that gross metric you're getting into capturing traffic and decoding it.

gdevenyi an hour ago

It would be really great to have some info about how to detect such things locally.

mongrelion 3 hours ago

What is a residential proxy?

gessha 2 hours ago

Second paragraph

RKearney 2 hours ago

The 4th sentence in the article has a link to What is a Residential Proxy?[0]

[0]: https://layer3intel.com/what-is-a-residential-proxy

duiker101 2 hours ago

From the article:

> Residential proxy services sell access to everyday devices, letting customers send traffic through them so it appears to come from that device's network.

whalesalad 2 hours ago

There are services you can pay for such that you can route internet traffic thru a specific IP in a specific part of the world. People (usually unwillingly and unknowingly) run software that effectively makes them part of a giant botnet. A computer running in Romania might have some kind of weather application or gambling/casino app that I could use to make an HTTP request as if I were on their network. So if you need access to 1,000 or 10,000 IP's to circumvent rate limits or perform crawling tasks, this is how you could do it.

georgel 2 hours ago

There are companies that provide proxy services for scraping services, and residential proxies route through consumer networks (like Comcast) which is flagged less than a datacenter IP.

Many questionable TV streaming boxes pretend to deliver you video, but in reality they are also piggy backing on your personal ISP to power those companies.

sparkling 2 hours ago

>Many questionable TV streaming boxes

+ Sketchy Apps

+ Malware

+ Weird Android Variants

microcode 2 hours ago

Even not so questionable TV's do this too. https://spur.us/blog/smart-tv-apps-residential-proxy-sdks

dormento 2 hours ago

It means some networked devices in there are being remotely piloted to tunnel network traffic to somewhere else. This scenario usually happens with more "unprofessional" ISPs, which sell bandwidth from their networked clients for people in need of such services.

Such as ignoring web scraping countermeasures, and DDoS.

2OEH8eoCRo0 2 hours ago

Essentially lets bad actors use your home network.

charcircuit 2 hours ago

Bad actors as defined by who. Why am I bad for not living in the right country to access a website.

derektank an hour ago

Because the person whose IP you’re using as an exit node probably hasn’t fully consented to it being used as such.

ZoneZealot 2 hours ago

It's described at a high level in media often. Here's more detail though:

Person buys a product, or downloads some software - that unknowing to them, was reaching out to a central server elsewhere to establish a network tunnel. And over that tunnel, the other server routes traffic onto that person's home network. Which can then of course go onto the internet, and it appears like the traffic originated from their home internet connection.

Other people rent access to this network. The goal being, you have surreptitious access to appear as any one of tens of thousands of home network IP addresses on the public internet. Bad guys can use this to rotate through many different IP addresses when their access gets blocked because of malicious (or benign but unwanted) behavior on the internet. Residential IP addresses are more 'valuable' because they don't have the negative connotation that datacentre and commercial IPs can have, and they can be spread geographically or across many ISPs.

A very common way for people being a part of these residential proxy networks is by buying dodgy streaming boxes, and also installing shady apps on TV app marketplaces.

superjan 2 hours ago

I was expecting that VPN’s (maybe not all) also use their own customers as relays, but you don’t mention them. Am I wrong?

charcircuit 2 hours ago

That kind of VPN is considered a residential proxy.

dylan604 26 minutes ago

Honestly, I expect any of those free VPN services that require an app install to be doing precisely this. At this point, I just assume anything with "free" in it will cost me more than if I just paid for something instead.

ZoneZealot 24 minutes ago

You're right, a lot of 'free VPN' software also uses your own internet as a residential proxy. It's often mentioned in the ToS but the users don't read that.

cpburns2009 2 hours ago

This isn't a theoretical problem either. My employer's website was being hammered by residential proxies a month ago. It wasn't until we setup WAF captcha rules that they mostly subsided. It wasn't even the typical exploit scanner. I don't know what the purpose was but it was effectively a DDoS.

hackernud3s an hour ago

They really should have said "botnet malware detected", it turns the White House into an exit IP for someone's else's botnet.

rconti an hour ago

Some good answers in this thread. I had the same question but I'm still a tad confused:

* I initially thought this meant someone in the WH network was using commercial proxies to appear as if they were exiting from a different network (which would align with "some user is firing up a proxy on their phone to exit in a different location")

* But then the description of residential proxies seemed to align more with traffic hitting an endpoint in the White House, and _exiting_ from the network there. But this didn't explain the timing (why isn't it 24/7).

* Finally it sounds like some person, legitimately on the WH network, has a device (cell phone, TV, whatever) that, when activated, is proxying outside traffic into the WH network.

jefurii 2 hours ago

But her e-mail server!

pak9rabid an hour ago

Love me some buttery males

threecheese an hour ago

"Infected with a proxy SDK" wouldn't be my first guess. Am I jaded? A realist?

natebc 43 minutes ago

I wish these were the most dangerous thing in the White House.

opengrass 2 hours ago

NSA honeypots

geephroh 22 minutes ago

I would actually feel better if this were the case, but given that we have "the very best people" currently running our cybersecurity infrastructure I doubt it.

Most likely scenario is a 20-something holdover from DOGE who accidentally had his phone p0wned while downloading groyper memes.

Bassiestroep 3 hours ago

I mean supply chain-attacks are everywhere. Smart-TV's with certain marketplace apps, IoT devices. Also, I'm surprised the white house's network is not monitored more.

thombat 2 hours ago

Monitoring is the easy part, remedying the problems has proved harder. From early in the first Trump administration:

https://lieu.house.gov/media-center/in-the-news/what-can-we-...

spiderfarmer 3 hours ago

That is not an environment for serious people anymore so that's expected.

charcircuit 2 hours ago

>that poorly secured proxy SDKs can allow internal network access and lateral movement.

Let me guess. The SDK being used does properly handle this and this whole article is anti residential proxy FUD.

hbcdbff 43 minutes ago

Slop

JudahNyquist 2 hours ago

probably something IOT with a vulnerability, happens all the time.

09712306130 2 hours ago

Seems like the president found a business opportunity and gave internal orders to rent out the network infrastructure to 'ethically sourced' providers :^) Jokes aside, might be some infected IoT crap.

I buy and use residential proxies, though.

sfmike 3 hours ago

Vibe coders really having fun on their side quests these days

vanyle 2 hours ago

Residential proxies are a very important part of the internet, they allow scraping for archiving, automation and can be used for extra anonymity.

While they have grown a bit too much, they are a natural response to the absurd amount of effort every website is pouring into anti-scraping tech.

georgel 2 hours ago

I wouldn't call turning on CloudFlare's bot blocker an "absurd amount of effort" from the perspective of site owners.

But getting around it sure is annoying, sometimes I get flagged IP's from Comcast and can't visit sites like costco.com despite not doing any questionable stuff on my network.

sparkling 2 hours ago

>absurd amount of effort every website is pouring into anti-scraping tech.

Maybe some people do not want to provide their entire website as free training material to [insert LLM lab here]?

ethin 2 hours ago

You... Do know that people scrape websites for non-AI reasons, right?

anonreplier an hour ago

Why should the site owners be interested in allowing them to do that?

squidmaster 2 hours ago

Virtually all of it is the product of malware. This is like you saying that robbery is very important because you like buying cheap tools at pawnshops.

10111001 2 hours ago

> Residential proxies are a very important part of the internet, they allow scraping for archiving, automation and can be used for extra anonymity.

Aren't they almost always run unknowingly, by people tricked into running them?

dabbz 2 hours ago

There exist services that will pay you a fraction of money to host their residential proxy service on a computer you own. But I do think the majority of residential proxies are hijacked.

kube-system 2 hours ago

There are providers who claim they are ethically sourced, and that users have consented. Although I guess many are users who don't know or care that it is happening.

Ethically, if someone just wants to play a free game and doesn't care about it, is it okay? How knowledgable does a user have to be in order to have informed consent?

10111001 an hour ago

> There are providers who claim they are ethically sourced, and that users have consented. Although I guess many are users who don't know or care that it is happening.

Betcha that means there was "consent" language on page 55 of some click-through EULA.

kube-system an hour ago

The landscape spans the gamut of everything from malware to explicit consent: https://packetstream.io/share-bandwidth/

xyzzy_plugh 2 hours ago

Leveraging compromised devices is a very important part of the Internet??? This is an incredibly twisted perspective.

Help me understand. As far as I'm aware, these residential proxies are almost always malware.

Bender 2 hours ago

Most tools can be dual-use. Residential proxies are also used by malevolent actors to hack infrastructure or financial institutions and let some other poor soul get investigated for it. This is why we can't have nice things.

kube-system 2 hours ago

They're also used by the good guys who are going after those exact same bad guys.

Bender 2 hours ago

True, though unfortunately people can not be trusted to declare their intentions so the residential proxies will ultimately have to be sacrificed and given they are fairly easy to identify by behavior I could foresee the feds now having a reason to round 'em up faster. They already took out NetNut, IPIDEA, SocksEscort, Doppellganger and the "Kim Wolf" Offshoots.

kube-system 2 hours ago

Some of the more legit providers have KYC in place, and do literally require you to declare you intentions to open an account, and block certain traffic proactively unless you can prove a legitimate use.

Bender 2 hours ago

How do I identify which residential proxies have gone through KYC and which are wanting to pour hot sauce in my under garments?

kube-system 2 hours ago

The ones that do KYC list it pretty prominently on their website.

Bender an hour ago

They list the IP addresses of all the residential proxies? Is there a link to the netsets of all the IPv4 addresses they are using I can download once a day? (preferably over rsync but git over https is fine too)

amritananda an hour ago

I don't think even the most "ethical" providers are going to volunteer that information, since that defeats the entire purpose of having a residential proxy in the first place.

kube-system an hour ago

No...? That's a completely different question than what we were talking about above? The customers of a residential proxy who would be subject to KYC are the people using the addresses -- this has nothing to do with the exit addresses of those who have joined the network.

Bender 36 minutes ago

That's a completely different question than what we were talking about above?

In fairness to me, I did say "Most tools can be dual-use. Residential proxies are also used by malevolent actors to hack infrastructure or financial institutions and let some other poor soul get investigated for it. This is why we can't have nice things."

So it could be Alice. I know Alice has good intentions. It could be Bob, we know what Bob is up to but I will give him a pass regardless because Bob did nice things in the past. But then there is Mallory ... Mallory Malfoid is up to no good. I need to know which IP's are used by Alice and Bob so I can exclude them from my automated protections. Mallory will automatically get rate limited to 16kb/s, 1 HTTP request every 5 seconds and if they bounce around different residential proxies they get redirected to a bathtub regardless of which residential proxy they use.

kube-system 26 minutes ago

Yes, but KYC is a process where the service provider is making that determination. Either to a legal standard and/or their own standards.

In no world does "KYC" mean "expose your customer list to the whole world", let alone undermine the entire purpose of the product you're selling.

"I want to dox all of the customers of a proxy provider" is just an unreasonable ask. We wouldn't expect or want ISPs or VPNs or telecoms to do this.

benjojo12 2 hours ago

Did a residential proxy provider write this

mcmcmc 2 hours ago

Frontier lab training data “collector”

lakeviewterrace 2 hours ago

Huh, and I wonder why I've been getting tons of "you might be a bot" CAPTCHA challenges from Google lately.

mcmcmc 2 hours ago

Hard disagree. They are malware 99.9% of the time. The utility does not erase the fact they are abusive.

lakeviewterrace 2 hours ago

"Malware is an important part of the Internet"

> and can be used for extra anonymity

Great, so you can conduct illegal transactions and have some unsuspecting grandma take the blame and have her front door kicked in?

kube-system 2 hours ago

Just like Tor, encryption, VPNs, etc, there are tons of legal uses for these proxies as well.

lakeviewterrace 2 hours ago

People who run Tor exit nodes generally do so by choice, and know the risks implications involved.

They didn't just connect a coffee pot to their WiFi one day.

kube-system 2 hours ago

Not all of these networks are built via malware.

e.g. https://packetstream.io/share-bandwidth/

timacles an hour ago

"Malware is an important part of the Internet

Technically correct statement though

OptionX 2 hours ago

And making DDoS-attacks nigh impossible to IP block.

Residential proxies are in many cases at least shady, both on the side of who uses them and for what and on providers that are often not above using dark pattern to hide them in some innocuous app for a smart-whatever that silently runs a proxy on a unaware user's connection. And in many places in the world if illegal stuff in done using your connection you are liable, regardless if you knew about it.

mikestew 2 hours ago

Residential proxies are a very important part of the internet

So important that we have to trick people into using them. Remember when folks were running SETI@Home? Of course you do, because it was widely thought to be a good thing, and folks willingly signed up.

How many would buy the "box" if the advertising were honest about what's actually in the box?

mzajc 2 hours ago

s/Residential proxies/DDoS networks/, then re-read your comment.