There is a specific kind of internet traffic that shows up looking completely legitimate. It arrives from a residential IP address, on a consumer ISP, in the same city as the account it is trying to access. It clears geolocation checks, sails past velocity rules, and does not trip the “impossible travel” logic in your identity provider. It looks like a customer sitting on their couch.
Sometimes it is a customer sitting on their couch. The problem is that the couch also has a cheap Android TV box plugged into the wall behind it, and that box has been quietly renting out its internet connection to whoever is willing to pay.
This is the residential proxy economy, and the streaming device sitting in millions of living rooms has become one of its favorite recruitment pools.
How a $40 box becomes infrastructure#
The mechanics are not exotic. A residential proxy network needs one thing to be valuable: a large, geographically diverse pool of real consumer IP addresses that fraud systems trust by default. Corporate datacenter IPs are easy to flag. A home broadband connection in a mid-sized US city is not.
Cheap Android TV boxes solve the supply problem beautifully. They ship in enormous volume, they run a full Android stack, they sit powered on and connected around the clock, and most owners never look at them again after the first setup. In many cases the malware is present before the box is ever unboxed, planted somewhere in a manufacturing or distribution chain that nobody audits. In other cases it arrives with the apps, because the person who bought a box to watch free channels went and installed exactly the kind of software that carries a hidden passenger.
That passenger is usually a proxy SDK. When Google moved against the NetNut network in July 2026, it described the enrollment method directly: the operators distributed SDKs built for devices commonly found in homes, including smart TVs and streaming boxes, and folded them into large botnet families. Researchers estimated that network alone at roughly two million real consumer devices, tied to a proxy service that had been sold commercially. In a single week that June, Google counted 316 distinct threat clusters routing through those exit nodes, spanning both criminal crews and espionage actors.
Once the SDK is running, the box does two jobs. It does whatever the user thinks they bought it for, and it accepts inbound connection requests and forwards them out to the wider internet. To the destination, the traffic originates from the home. The actual operator could be anywhere.
Why SOCKS5 is the protocol of choice#
SOCKS5 is not malware. It is a general-purpose proxy protocol that forwards nearly any kind of TCP traffic without caring what is inside it. That protocol-agnostic quality is exactly why criminal proxy operators standardized on it, to the point that in underground markets the access itself is just called “socks” or “socks5.”
Because SOCKS5 does not inspect or rewrite application-layer content the way an HTTP proxy might, an operator can tunnel account-takeover attempts, credential stuffing, card testing, automated fraud, ransomware staging traffic, and data exfiltration through the same node with the same tooling. The device owner sees none of it. Their ISP sees a home connection making ordinary-looking outbound requests.
The catalog of what actually rides these tunnels is not theoretical. When authorities dismantled the SocksEscort proxy service in March 2026, the described use cases included bank and cryptocurrency account takeovers, fraudulent unemployment insurance claims, DDoS activity, and the distribution of child sexual abuse material. That service had offered access to hundreds of thousands of IP addresses since 2020 and still listed roughly 8,000 live infected routers when it was taken down, about 2,500 of them in the United States.
The IPTV connection#
If you want to understand why streaming boxes specifically, follow the money on the app side.
The demand for cheap all-you-can-watch television is enormous, and it drives a thriving market in preloaded Android boxes and jailbroken sticks that promise thousands of live channels for a flat fee. That IPTV layer is the perfect delivery vehicle. The user is already installing unofficial software from unofficial marketplaces, already sideloading, already granting broad permissions to get their channels working. Bundling a proxy component into that install is trivial, and the user has been conditioned to click through every prompt.
The result is a two-sided grift. The operator sells the streaming subscription and monetizes the same device a second time by renting its connection. The buyer paid to become the product.
The attribution problem, stated honestly#
This is where it pays to be precise, because the layers do not share a return address.
The device side of the current wave, the botnet families that conscript the boxes themselves, traces mostly to financially motivated cybercriminal groups operating out of Asia. Public research has tied the original operation and its successors to a handful of named crews responsible for the backdoors, the command infrastructure, and the ad fraud and proxy monetization. There is no clean line to a specific APT here. The operators are running a business, and the business is fraud at scale.
The proxy market and IPTV storefront layer looks different. Reseller operations, bulletproof-adjacent hosting, and the commercial “socks5” services that sell access have a long and well-documented Eastern European footprint, with the same operators recurring across takedowns going back years. Some of these storefronts are registered to real companies in the region.
Then there is the buyer layer, which is everyone. That is the whole point of a laundering service. When Google counted those 316 threat clusters in a week, the pool included criminal fraud operations and state-aligned espionage groups renting the same exit nodes to mask origin and blend into victim geographies. A residential proxy does not care who is paying. It exists precisely so that the traffic cannot be pinned to its true source.
So the accurate framing is not “one country runs this.” It is that the supply chain, the marketplace, and the customer base are three separate populations, and the entire value of the model is that it dissolves the connection between them. That dissolution is the product.
What this means for defenders#
The uncomfortable takeaway for anyone running fraud detection or identity controls is that “residential IP” has quietly stopped being a trust signal. A connection from a consumer ISP now tells you almost nothing about who is on the other end.
A few practical adjustments:
Stop treating residential geolocation as a low-risk indicator. Enrich authentication and transaction logs with proxy and hosting intelligence that specifically flags known residential-proxy ASNs and exit-node ranges. The match between a login IP’s city and the account’s city is no longer meaningful on its own.
Watch for the behavioral tells that survive the proxy. SOCKS5 hides the origin, not the behavior. Session timing, device fingerprint inconsistencies, and impossible sequences of activity from a single “home” IP are still visible. Lean on the layers the tunnel does not launder.
Feed known proxy infrastructure into your blocklists and update it often. These networks get disrupted and rebuilt on a cycle. Static lists rot. The takedowns of the last year are wins, but the model regenerates because the underlying devices are still in homes and still cheap to reinfect.
The device on the wall is not going anywhere. As long as people want a box that unlocks everything for the price of a lunch, there will be a market that sells them one and rents out the connection behind their backs. The traffic will keep arriving looking like a customer on a couch. The job is to stop taking that appearance at face value.
