In January 2026, Google's Threat Intelligence Group (GTIG) announced it had helped disrupt one of the largest residential proxy networks in the world, IPIDEA: devices were recruited through an SDK bundled into more than 600 Android apps, and in a single week in January 2026 over 550 threat actor groups were observed using the network's exit nodes. The network was reduced by roughly 40%. In July 2026, GTIG disclosed a similar operation against the NetNut (Popa) network — at least 2 million devices involved, with 316 threat clusters observed on its nodes in a single week in June. On March 12, 2026, the FBI's Internet Crime Complaint Center (IC3) issued its own public service announcement, PSA I-031226-PSA, specifically about devices exploited as residential proxies without the owner's consent. Here's how it actually works and what to do if you suspect your internet connection is being "rented out."
What a residential proxy actually is
A residential proxy is an IP address that belongs to an ordinary home or mobile subscriber rather than a data-center server. To a website, a request from that IP looks exactly like an ordinary person on an ordinary connection — not a bot, scraper, or server farm. That's exactly why these addresses are valuable: anti-fraud systems, CAPTCHAs, and IP-based blocking are built mainly to tell "real" people apart from server subnets, and a residential IP slips past that check almost invisibly.
Legitimate residential proxy networks exist — for example, for collecting public web data such as price scraping, listing checks, or testing how a site renders from different countries — and they get their IPs from users who knowingly agreed to share bandwidth for compensation. The problem starts where the same idea is used without clear consent: a device becomes part of a network, and its owner finds out last — either from a security tool or when they run into the consequences themselves. According to GTIG, demand for these IPs doesn't come only from marketing tools: in a single week in January 2026, more than 550 distinct threat groups were observed on IPIDEA's exit nodes, and 316 threat clusters were observed on NetNut's nodes in June 2026.
How a phone or computer ends up inside a proxy network
An SDK bundled into ordinary apps
The most common path is a software development kit (SDK) that a developer bundles into a game, utility, wallpaper app, photo editor, or any other app distributed through an official store, in exchange for payments from the proxy network's operator. The user installs a normal-looking app, agrees to the standard internet-access permission — and never sees an explicit warning that part of their connection is now being used by a third party. According to Google, this is exactly how more than 600 Android apps were set up to distribute the IPIDEA SDK; the network ran on Android, Windows, iOS, and even WebOS smart TVs.
Free VPNs where "payment" is your connection
Some free VPN services don't just earn from ads — they also turn the user's own device into an exit node for someone else's traffic, with the terms usually buried in a user agreement that almost no one reads. For a side-by-side of how this differs from a regular paid VPN, see free vs. paid VPN.
"Earn from your unused bandwidth" apps
A separate category of apps directly offers cash or credits for "sharing unused bandwidth": the user technically agrees to the terms, but ends up responsible for whatever happens on the network under their connection, without any way to actually control it.
TV boxes and other IoT devices
A similar scheme — but baked into the firmware itself rather than a single app — shows up on cheap Android TV boxes and some smart TVs. That's a separate story, covered in depth in how to check an Android TV box for infection, and we won't repeat it here.
Why this is a real problem for you personally
For an ordinary user, having a device inside a residential proxy network isn't an abstract risk — it's a set of concrete, practical problems:
- Someone else's actions on the network are technically coming from your IP — fraud, attacks on other services, or spam — and questions, in theory, land on you as the connection's owner.
- Your IP address lands on reputation blacklists, which is why CAPTCHAs start showing up more often and logins to banking and other important services can get blocked.
- The app causing it burns mobile data and battery in the background, even when you're not using it.
- According to the FBI, a compromised node can give attackers a foothold into your home network, putting other devices at home at risk too.
- An app with this kind of SDK already has persistent background network access — which means it potentially has access to whatever else it's permitted to touch.
Residential proxy vs. VPN vs. regular proxy: what's the difference
A residential proxy is not the same thing as a VPN, even though the two get confused often. The difference comes down to whose IP a site actually sees, and who knows that traffic is routed through a particular device:
| Service | Whose IP sites see | Who knows traffic runs through you | Payment model |
|---|---|---|---|
| Paid VPN (e.g. LiMP VPN) | The provider's server IP, usually a data center | You — the client; traffic runs through the provider's own infrastructure, not through other people's devices | Direct subscription |
| Free VPN with bandwidth-sharing | Often other users' IPs, including yours | Depends on the ToS: technically disclosed, but buried from casual reading | "Free" in exchange for access to your connection and/or ads |
| Residential proxy network via an app SDK | Your home/mobile IP acts as an exit node for third parties | Often without the user's clear understanding | The proxy network operator pays the app developer |
| Regular (data-center) proxy server | A data-center server IP | You configure the proxy connection yourself | Paid or free rental of a specific server |
How to tell if your IP is being used as a proxy
There's no single "infection counter," but there are warning signs worth checking if something feels off:
- Sites that used to open fine suddenly keep showing CAPTCHAs or flagging "suspicious activity" from your address.
- Some app is burning a noticeable amount of mobile or home data in the background even though you haven't opened it.
- Your phone noticeably heats up or drains battery at rest, with no obvious cause.
- Your router shows network activity at night when every device at home should be idle.
- Play Protect or your security app flags an app for suspicious network behavior.
Checking on Android
Open Settings → Network & internet → Data usage and check background data per app. Then go to Settings → Battery and sort apps by drain — an app that's unusually hungry "in the background" is often the culprit. After that, open Google Play Protect and run a manual scan.
Checking on Windows
In Task Manager, open the Performance → Network tab, or use Resource Monitor to see which process is holding steady network activity. Also check Settings → Network & Internet → Data usage to see how much data each app has used recently.
Checking on your router
Log into your router's web interface and open the connected-clients list with per-device traffic stats — an unfamiliar device, or an anomalous amount of traffic on a known one, is worth investigating further. A full walkthrough of this step is in who's connected to my Wi-Fi.
How to remove a proxy SDK and lock things down
If you've found an app behaving suspiciously, here's the order of operations:
- Find the specific app responsible using the background data and battery check above.
- Uninstall it completely — don't just force-stop it, actually remove the app, or the background process and its SDK will keep running.
- Run a manual Google Play Protect scan to confirm no other similar apps remain.
- Review the permissions and special access of your remaining apps — especially VPN profiles, auto-start, and unrestricted background activity. See which app permissions are dangerous for a full walkthrough.
- Block background internet access for any questionable apps that don't actually need a constant connection — step by step in how to block an app's internet access.
- Change your Wi-Fi password and your router's admin password, and check for a firmware update — this closes the door if the device already had a foothold on your home network.
- If doubts remain, factory-reset the device and reinstall only vetted apps from the official store.
Which apps are high-risk, and how to pick safer ones
A few categories of apps show up in this risk group most often:
- Free VPNs with no clear way of making money — if a service sells nothing and shows no ads but is still free, it's likely monetizing your traffic or data somehow. See real-world examples in malicious VPN apps.
- Apps that directly offer rewards for "sharing unused internet."
- APK files downloaded from outside the official store — these deserve extra scrutiny, as covered in how to check an APK for malware before installing it.
- Apps with no public privacy policy, from a publisher with no track record of other products or long-standing reviews.
If you do need a VPN on your phone, it's smarter to pick a service with a transparent subscription and a clear business model from the start, rather than a free one with murky terms. For Android, that can be LiMP VPN for Android — a no-logs service that makes money from subscriptions, not from reselling your traffic to third parties. It's worth being clear-eyed here: a VPN by itself doesn't "cure" an infected app or remove a third-party SDK from your device. Its real value is simply not installing a free VPN that is itself a proxy network in place of a vetted service.
Checklist: how to avoid becoming someone else's proxy
A handful of habits go a long way toward reducing the risk of your device becoming someone else's exit node:
- Only install apps from official stores, and only from developers with a verified track record.
- Keep Google Play Protect turned on — don't disable it to "speed up" your phone.
- Check background data usage per app roughly once a month in your network settings.
- Don't install apps that offer payment for "unused internet" or "shared bandwidth."
- Skip free VPNs with no transparent business model in favor of a paid service with a clear subscription.
- Keep your OS, router firmware, and other smart-device firmware up to date.
- When buying TV boxes and other smart devices, look for Play Protect certification.
- If CAPTCHAs and blocks suddenly show up across every device at home at once, check your router and smart TV too, not just your phone.
