Originally published on proxymint .

A residential proxy botnet rents out hijacked routers, TV boxes and phones as proxy exits. How devices get enrolled, the 2024-2026 cases, and how to check.

TL;DR

A residential proxy botnet rents out hijacked home devices as proxy exits. Routers, cameras, Android TV boxes and phones relay strangers' traffic, so the target sees a household IP and the owner never agreed.

Enrolment needs nothing unusual from the owner. Default passwords, old firmware, TV boxes sold with a backdoor, open debugging ports and pirated software account for most infections in the 2024-2026 cases.

Takedowns cut infrastructure, not the device pool. Lumen counted close to 60 million victim IPs in proxy botnets in July 2026, after the IPIDEA and SocksEscort actions.

Consent is the line between a botnet and a residential network.…