Skip to content

Proxyjacking: How to Check Where Your Residential Proxy IPs Come From

By . Published

Somewhere in one of 34 countries, a D-Link storage drive sits on a shelf doing what it was bought to do. It also carries strangers' web traffic, and its owner has no idea.

In October 2026, threat intelligence firm GreyNoise found at least 143 hacked NAS drives, video recorders and servers quietly running a bandwidth-sharing app. Each one was earning payouts for the attacker by acting as a residential proxy exit node. If you buy residential proxies, some of your requests may leave through a device like this.

This article covers what GreyNoise found, how hijacked devices end up in proxy pools, what it costs you as a buyer, and the questions that tell a clean provider from a risky one.

Quick answer: What is proxyjacking? Proxyjacking is when an attacker breaks into a device and installs proxy or bandwidth-sharing software without the owner's consent, then sells or monetizes that device's internet connection as a proxy. To avoid buying hijacked IPs, ask providers how each IP is sourced, whether consent is documented, and how they vet and monitor nodes. Or use ISP proxies, which run on provider-controlled servers instead of consumer devices.

What GreyNoise found

GreyNoise was looking into suspicious activity at one organization and found something bigger: a campaign that compromised at least 143 internet-facing devices in 34 countries, reported by BleepingComputer on October 15, 2026.

The attacker didn't build custom malware for the payout. They installed Pawns.app, a legitimate app that pays people to share their bandwidth, and let a commercial residential proxy network route traffic through each device. More devices meant more payouts.

The way in was old, known bugs on gear nobody patches:

Device Vulnerability exploited Year CVE published
D-Link ShareCenter NAS CVE-2024-3272, CVE-2024-3273 2024
Ubiquiti UniFi Video NVR CVE-2021-44228 (Log4Shell) 2021
SAP NetWeaver Visual Composer CVE-2025-31324 2025
Hikvision and Dahua DVR/NVR Not specified in reports Unknown

In some cases the attacker also added SSH keys as a backup way back in. That means patching the original bug may not be enough to evict them.

143 devices is small. The pattern is what matters: storage boxes and camera recorders are always on, rarely updated, and sit on real home and business connections. That makes them exactly what residential proxy networks want.

How hijacked devices end up in residential proxy pools

Residential proxies need real home and business connections, and someone has to supply them. GreyNoise's case is one route among several. Google's Threat Intelligence Group documented the full range when it disrupted the IPIDEA network in January 2026:

  1. Bandwidth-sharing apps. People install an app and get paid to share their connection. That is legitimate when the owner chooses it. Proxyjacking is the same app installed by an attacker.
  2. SDKs buried in other apps. App developers get paid to embed a monetization SDK. The app does what it advertises while the SDK turns the phone or PC into an exit node. Google found over 600 Android apps with code connecting to IPIDEA's infrastructure.
  3. Trojanized software. Free VPN apps and fake system utilities enrolled devices without clear disclosure.
  4. Preloaded devices. Some uncertified Android TV boxes shipped with hidden proxy software already installed.
  5. Outright compromise. Exploiting unpatched routers, NAS drives and recorders, as in the GreyNoise campaign.

The scale is not small. In a single week in January 2026, Google saw more than 550 threat groups using IPIDEA exit IPs, and the disruption removed millions of devices from the pool. Google also found that providers' "ethical sourcing" claims were often wrong or overstated.

The IPs these routes produce look the same to you as a buyer. A consenting user's laptop and a hacked DVR both show up as a residential IP on a consumer ISP. You can't tell them apart from the outside, which is why sourcing has to be verified with the provider.

What it costs you as a buyer

You can lose on three fronts when your pool includes hijacked devices: reputation, reliability and compliance. Each one shows up in your success rates or your legal review sooner or later.

1. You share IP reputation with attackers

GreyNoise's April 2026 report, The Invisible Army, analyzed 4.02 billion sessions from 5.72 million IPs over 90 days. Home connections made up 39% of the unique IPs targeting edge infrastructure.

Those same consumer IPs are what residential pools sell. When a home IP has been used for scanning or credential stuffing, anti-bot systems learn to distrust it, and your scraper inherits that history. The FBI flagged this pattern back in 2022, warning that attackers route credential stuffing through residential proxies because defenders flag them less often.

The report also cites IPinfo research finding that 46% of proxy IPs are offered by more than one provider at once. Switching vendors doesn't guarantee you get fresh IPs.

2. Your sessions run on hardware you don't control

A hacked NAS goes offline when it's patched, rebooted or unplugged. A home PC goes offline at night. GreyNoise measured a 34% night-time drop in traffic from India-geolocated residential IPs, compared with under 3% variation from servers.

For a long checkout flow, a logged-in session or a multi-page crawl, that churn means dropped sessions, retries and inconsistent data.

3. "Ethically sourced" is a claim, not proof

Google's IPIDEA investigation found sourcing claims were often incorrect or overstated, and said they should be backed by transparent, auditable proof of consent. If your data pipeline ends up in front of a legal or procurement team, "our vendor said so" is a weak answer.

The consequences are real at the extreme end. The 911 S5 botnet, taken down in 2024, sold access to more than 19 million IPs spread through free VPN apps. Authorities alleged it was tied to $5.9 billion in unemployment insurance fraud.

7 questions to ask before you buy proxies

A good provider can answer these without hesitating. Vague answers to the first three are your signal to walk away.

Question A good answer sounds like Red flag
Where do your IPs come from? A specific source: owned ranges, leased ranges, or a named opt-in app "Our global network" with no detail
How do device owners consent? A clear opt-in screen and payment terms you can see, or no consumer devices at all "Users agree to the terms of service"
Do you use third-party SDKs or resold pools? No, or yes with named partners and audit rights Can't say, or won't say
Are any consumer devices in your network? No, everything runs on servers the provider owns Yes, or "it depends on the pool"
Where is your infrastructure hosted? On the provider's own servers Can't say who runs the exit nodes
Do you monitor the network for abuse? Yes, traffic is watched for malicious activity No process described
Can I verify who owns the IPs? Yes, ownership checks out in a public WHOIS or ASN lookup Lookups show unknown or mismatched owners

You can also check a sample yourself. Run a handful of IPs through a WHOIS or ASN lookup and an IP reputation service. If ownership is murky or the IPs already carry abuse flags, you've learned something about the pool before you signed anything.

ISP vs residential proxies: where sourcing decides it

ISP proxies take the consumer device out of the picture. The IP is registered to a consumer ISP, so websites see a residential-looking address, but it runs on servers the provider controls. No home PC, no app SDK, no hacked DVR.

That's the core trade. Here's how the two compare on what buyers care about:

Residential proxies ISP proxies
Where traffic exits Real consumer devices (phones, PCs, routers, IoT) Provider-run servers on ISP-registered IPs
Sourcing risk Depends on how devices were enrolled; hard to verify from outside No third-party devices involved
Speed Slower; limited by home connections 10 to 15x faster than residential, per Proxyway's 2026 ISP report
Session stability Devices drop off when turned off, patched or unplugged Static IPs stay up as long as the server does
Pool size and geo coverage Very large, many countries Smaller; largest networks cover 40+ countries, best IPs mostly US
Typical pricing Per GB Per IP, about $2 to $4 per IP per Proxyway

Residential proxies still win on raw pool size and long-tail geo targeting. If you need thousands of rotating IPs in small countries, that's their job.

For work that depends on speed, sticky sessions and a clean history, like account management, price monitoring, ad verification or high-volume scraping of major sites, ISP proxies remove the sourcing question entirely. Proxyway also notes the best ISP IPs come straight from major consumer ISPs and are hard to source at scale, which is why per-IP prices stay firm.

How Stat Proxies sources its IPs

We either own our IP ranges or lease them, and some of those leases come directly from ISPs. Every IP runs on our own servers. There are no consumer devices anywhere in our network: no apps, no SDKs, no one's home connection. More on that on our ethically sourced IPs page.

We also monitor traffic across the network for malicious activity.

Our static ISP proxies are US-based today, with Canada and London coming soon. See pricing for current plans.

FAQ

What is proxyjacking?

Proxyjacking is when an attacker compromises a device and installs proxy or bandwidth-sharing software without the owner's knowledge, then earns money by routing other people's traffic through it. In October 2026, GreyNoise found at least 143 devices in 34 countries hijacked this way using the Pawns.app bandwidth-sharing app.

Is it legal to use residential proxies?

Using proxies is generally legal, but where the IPs come from matters. If a provider's network includes devices enrolled without consent, you carry reputational and compliance risk even if you didn't know. This is not legal advice; check with counsel for your use case.

How can I tell if a residential proxy provider is ethically sourced?

Ask for specifics: where IPs come from, how owners opt in, whether third-party SDKs or resold pools are used, and how nodes are monitored. Google's threat team has said sourcing claims should be backed by transparent, auditable proof of consent.

Are ISP proxies safer than residential proxies?

On sourcing, yes. ISP proxies run on provider-controlled servers using ISP-registered IPs, so no consumer devices are involved. They are also faster and more stable, but pools are smaller and geo coverage is narrower.

Can a hijacked IP hurt my scraping success rate?

Yes. Consumer IPs used for scanning or credential stuffing get flagged by anti-bot systems, and that history follows the IP. Devices that drop offline also break sessions and force retries.

What should I do if I think my device is being used as a proxy?

Patch firmware on internet-facing devices like NAS drives and video recorders, change default credentials, check for unknown apps and SSH keys, and avoid apps that pay you to share bandwidth unless you trust them.

Sources