A residential proxy network is a group of consumer devices, such as phones, computers, and streaming boxes, that act as exit nodes and route other people's traffic through IP addresses that internet service providers assigned to home users. The operator sells access to these exit nodes as residential proxies, so target sites see a home connection instead of a data center.

To work, the network needs code running on each consumer device that enrolls it as an exit node. How that code gets there decides whether the device owner knowingly agreed to share their connection.

How Devices Join a Residential Proxy Network

  • Bandwidth-sharing apps: Some users knowingly install software that promises to pay them for spare bandwidth.
  • App SDKs: Proxy SDKs are offered to app developers as a way to monetize their apps. Once embedded, the SDK turns the device into an exit node alongside the app's normal function.
  • Preloaded or malicious software: The FBI has warned that some devices are infected before sale or during setup and then become part of residential proxy services used for malicious activity.

Risks for Device Owners

  • Reputation: Traffic the owner does not control leaves through their IP, which can get that IP flagged as suspicious or blocked.
  • Security: Google's threat intelligence team found that a network it analyzed also sent traffic to exit devices to compromise them, exposing other devices on the same home network.

How Traffic Reaches an Exit Device

Google's analysis of one large network shows a two-tier control setup:

  • Check-in: On startup, the device contacts a first-tier server, sends diagnostic data and gets back a list of second-tier servers.
  • Polling for tasks: The device regularly asks a second-tier server for work.
  • Proxying: When there is traffic to route, the server sends the destination hostname. The device opens a connection to that host and passes the data on unmodified.
  • Shared pools: Operators share device pools through reseller agreements, so one exit device can carry traffic sold under several brand names.