Loading story…
Security researchers reported that residential proxy networks are increasingly being used to route malicious traffic through legitimate home internet connections, helping attackers evade IP reputation controls while making abuse appear to come from ordinary consumers and organizations. Infoblox said more than 65% of its cloud customers queried domains tied to residential proxy services in 2026, with monthly DNS traffic rising from roughly 300–400 billion queries in early 2025 to more than 500 billion by April 2026, affecting every industry vertical examined, including healthcare, pharmaceuticals, banking, government, electronics, food and beverage, and industrial sectors. The company also observed no meaningful drop after disruption efforts against IPIDEA, and recorded a 265% single-day spike in queries to ipinfo[.]ipidea[.]io on January 23.
Separate telemetry from Gen Digital linked residential proxy traffic to 7.4 million malicious incidents affecting 572,000 users since January 2026, with notable concentration in India, Vietnam, and Brazil. Researchers said devices are often enrolled through pay-for-bandwidth apps, free VPNs, browser extensions, bundled SDKs, preinstalled Android TV software, IoT devices, malware, and potentially unwanted applications, sometimes without clear user consent. The reports warn that these networks are being used for phishing, credential stuffing, account takeover, ad fraud, scams, scraping, and reconnaissance, while shifting legal, reputational, and performance risks onto households and enterprises whose IP addresses become exit nodes. Recommended mitigations include Protective DNS, DNS log reviews, auditing apps and browser extensions for embedded proxy components, inspecting connected devices, and removing unknown or suspicious software.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Gen Digital published a report warning that consumer devices and home internet connections can be turned into residential proxy exit nodes through apps, bundled SDKs, or malware, exposing households to attribution, security, and reputational risks.
Infoblox published research stating that more than 65% of its Threat Defense Cloud customers queried domains associated with residential proxy networks in 2026, with exposure spanning all industry verticals examined.
By April 2026, Infoblox said monthly DNS traffic to proxy-related domains had grown to more than 500 billion queries, reflecting continued expansion of residential proxy activity across customer networks.
In March 2026, the FBI warned that threat actors were compromising consumer internet-connected devices and routing malicious traffic through home IP addresses to evade detection. The warning highlighted neglected or low-cost devices such as routers, modems, streaming boxes, smartphones, tablets, and digital picture frames as common targets.
Infoblox observed a 265% single-day increase in customer networks querying ipinfo[.]ipidea[.]io on January 23, describing it as an anomaly around the IPIDEA disruption.
Gen Digital said that since January 2026 it observed 7.4 million malicious incidents tied to residential proxy traffic affecting 572,000 users, with activity concentrated in countries including India, Vietnam, and Brazil.
Infoblox said action was taken against the residential proxy service IPIDEA in January 2026, but observed no meaningful decline in related residential proxy traffic afterward.
Infoblox reported that DNS queries to domains used to access or orchestrate residential proxy networks began a steady rise starting in January 2025, eventually reaching more than 500 billion monthly queries by April 2026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
osintteam.blog
Open sourcecybersecuritynews.com
Open sourcegendigital.com
Open sourceinfoblox.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google and partners disrupted **IPIDEA**, described as one of the world’s largest **residential proxy networks**, which routed attacker traffic through millions of consumer devices acting as proxy “exit nodes.” Google Threat Intelligence Group (GTIG) reported that in a single seven-day period in January 2026, **550+ tracked threat groups** used IPIDEA-linked IPs to obfuscate operations including access to victim *SaaS* environments, intrusion activity against on-premises infrastructure, and **password-spray** attacks; activity was attributed across multiple geographies including **China, DPRK, Iran, and Russia**. IPIDEA allegedly enrolled devices via **SDKs embedded in mobile and desktop applications**, including trojanized apps and “bandwidth monetization” lures, enabling the sale of residential IP space that can be abused for credential abuse, scraping, ad fraud, phishing, and C2 evasion. The disruption effort included **legal action and domain takedowns** against infrastructure used to control devices and proxy traffic, with reporting indicating IPIDEA’s primary site became inaccessible and that the action degraded the available device pool by **millions**. Google also implemented ecosystem enforcement measures, including **Google Play Protect** blocking/removing apps containing IPIDEA SDK components, and shared intelligence intended to reduce re-enrollment and impact related proxy operators that rely on shared/resold device pools and rebranded services (e.g., *360 Proxy*, *Luna Proxy*). Separate reporting tied abuse of residential proxy services like IPIDEA to botnet activity (e.g., **AISURU/Kimwolf**) and highlighted the user risk of having home networks unknowingly used for third-party traffic, increasing exposure to compromise and reputational harm.
Jun 29, 2026
Google’s **Threat Intelligence Group (GTIG)** and industry partners took coordinated legal and technical action to disrupt **IPIDEA**, described as one of the world’s largest *residential proxy* networks used to mask malicious activity behind legitimate household and small-business IP addresses. Google reported pursuing court action to seize/take down domains used to command infected devices and manage proxy traffic, while also sharing intelligence about **IPIDEA software development kits (SDKs)** with platform providers, law enforcement, and researchers to enable broader enforcement. Google said the operation **significantly degraded** IPIDEA by reducing the available pool of proxy devices by **millions**, with impact likely extending to affiliated/resold proxy services that share infrastructure. On Android, Google expanded protections via **Google Play Protect**, including alerting users, removing apps known to include IPIDEA SDKs, and blocking future installation attempts on certified devices. Reporting linked IPIDEA SDKs to enrollment of devices into multiple botnets (including **BadBox 2.0**, **Aisuru**, and **Kimwolf**) and noted GTIG observed **550+ threat groups** using IPIDEA exit nodes over a seven-day period in January 2026; affected devices reportedly spanned smartphones, Windows PCs, and other consumer hardware, with US/Canada/Europe residential IPs particularly sought after.
Jun 29, 2026
Researchers reported that malicious Android applications, including VPN-themed apps and software built with the **LumiApps** SDK, secretly enrolled users’ devices into a proxy network and routed third-party traffic through them without informed consent. HUMAN’s Satori team said the operation, tracked as **PROXYLIB**, used a Golang-based native library, `libgojni.so`, to contact command-and-control servers, register infected phones, and maintain persistent proxy connections through Android services and boot receivers. The activity was linked to earlier infections found in **Oko VPN** and 28 related Google Play apps, as well as a later variant that could be embedded during app development or injected into APKs without source-code access. Investigators said the infrastructure and monetization appeared tied to **Asocks**, a residential proxy service, indicating the compromised devices were likely being sold as proxy exit nodes for cybercriminal use. Google removed the identified apps from Google Play, and **Google Play Protect** now detects or blocks known PROXYLIB-related applications, while researchers warned the operators are likely to keep shifting to third-party app stores and modified APK distribution.
Jun 29, 2026