That cheap streaming box under the TV may be doing a second job you never agreed to. On November 2, Google said it worked with industry partners to dismantle a botnet of more than 1.3 million Android TV set-top boxes. The boxes shipped with malicious software that secretly rented the owner’s internet connection to strangers and ran advertising fraud.
Two days later, researchers reported that residential proxy nodes were beaconing out from the network reserved for the Executive Office of the President (AS2650). In practice, anyone willing to pay a few dollars could route their traffic through a White House IP address.
Both stories involve the same business: renting out home internet addresses. This post covers how that business works, why it gets around one of the oldest defenses we have (blocking by IP address), and what defenders and ordinary households can actually check.
What a residential proxy actually is
A residential proxy service lets customers rent someone else’s internet address to anonymize their traffic or spoof their location. The point that matters is this one: from a website’s perspective, the traffic appears to come from the rented IP address, not from the proxy customer.
The “inventory” is ordinary devices: phones, PCs and TV boxes. Their IPs get into the pool in two main ways:
- Bundled SDKs. App developers can embed software development kits from proxy networks to monetize their apps and get paid a small amount per installation. The White House activity was linked to Windows 11 installs of Infatica, a proxy program often integrated into “free” apps.
- Pre-infected hardware. In the XCPE case, Google’s threat intelligence group concluded that manufacturer Videostrong Technology Co. included malware that enrolled more than 1.3 million set-top boxes in the botnet.
How the XCPE botnet worked
Google requires Android device makers to pass compatibility and security tests. Even so, Videostrong found a way to load its malicious software immediately after a device’s first boot. Google says it has since closed that gap.
Once installed, the backdoor became a distribution platform. According to GTIG, Videostrong sold access to criminal affiliates and loaded their malware modules onto infected devices. Those modules included SDKs from several residential proxy providers.
The malware wasn’t limited to TV boxes. It also turned up in telehealth devices, karaoke machines and digital signage.
| Name | Role in the reporting | Note |
|---|---|---|
| Videostrong Technology Co. | China-based TV box maker that GTIG says shipped the XCPE malware | Google cut ties and took legal action against its control servers (source) |
| MECOOL (Skyworth Technology) | Pre-infected box that bundled Videostrong’s malware | Finding from Synthient’s teardown (source) |
| AppSalt / Honeygain (Oxylabs) | Proxy SDK downloaded by infected devices | Oxylabs says consent signals were faked (see below) |
| NetNut (Alarum Technologies) | Proxy provider linked to the botnet | The FBI seized hundreds of its domains in July 2026 over a separate botnet called Popa (source) |
| Grass | Proxy software that Synthient says Videostrong also distributed | Grass’s founder previously denied any tie to a different box maker, Superbox (source) |
| EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb, GaGaNode | Also named in the GTIG report | Named only; no further detail given (source) |
The accounts disagree, and that’s worth knowing
Oxylabs said after publication that its system won’t use a device as an exit node unless it receives a consent signal, and that the developer faked those signals. It said it had no record of Videostrong. It did find a supplier tied to “com.abc[.]nexus”, which GTIG names as a malware loader. Oxylabs says that supplier made up under 1% of its IP pool, and that it suspended the relationship.
So the consent mechanism existed on paper, and it still failed. A consent flow controlled by whoever builds the device gives the person using the device very little protection.
How big this really is
The 1.3 million figure is probably low. GTIG estimates the takedown should sever access to at least 10 million additional compromised devices, because Videostrong’s affiliates had other distribution channels. Synthient founder Ben Brundage called 1.3 million “highly conservative.”
The White House case: a clean real-world sample
Layer3 Intel didn’t target the White House. The team said it caught this by chance while requesting global rotating access through public proxy services. “This is public access,” they wrote.
What it measured between October 5 and November 3:
- Proxies exited from the White House network 236 times.
- Exits came from six IP addresses on 26 of the 30 days, mostly between 5 p.m. and midnight.
- 28 separate residential proxy services could exit through the network.
Two details make this worse. Infatica’s founder ran King Servers, the hosting firm that held six of the eight IPs Russian state services used against Arizona and Illinois election systems in 2016. And the price is low. Brundage said some resellers sell bandwidth for as little as 60 cents a gigabyte, often without Know Your Customer checks.
The White House isn’t unusual. Spur found residential proxies in nearly 300 government networks, 318 utilities, 166 healthcare organizations and 141 banking and finance firms. Infoblox found that 65% of its customers were querying one or more residential-proxy-related domains.
Why IP-based blocking stops working
A lot of defensive tooling assumes an IP address tells you something about who is behind it. Residential proxies break that assumption. The table below is analysis built on one sourced fact: the website sees the rented address, not the customer.
| Control | What it assumes | What residential proxies do to it |
|---|---|---|
| IP blocklists | Bad traffic comes from a recognizable, reusable set of addresses | The traffic exits from ordinary home and office IPs that real customers also use |
| Geo-fencing | The IP’s location is the user’s location | Location spoofing is a core selling point |
| Datacenter/hosting ASN filters | Abuse comes from cloud ranges | Exits sit on consumer ISPs, and even on a presidential network |
| Allowlisting “trusted” networks | Traffic from a partner or government range is trustworthy | That range may be for rent to anyone |
| Rate limiting per IP | One attacker means one or a few IPs | Rotating pools spread requests across many addresses |
That’s why these networks show up behind account takeover, ad fraud and mass AI content scraping. If you block the IP, you block a family or a workplace, and the attacker just rotates to the next address.
The risk goes both ways
The owner of the device isn’t just lending out an address. In late 2025, criminals were mass-exploiting a flaw in these services to probe each proxy endpoint’s local network for systems to infect. Synthient documented how the Kimwolf botnet used that kind of weakness to compromise other Android devices inside users’ home networks and launch record DDoS attacks. Dozens of providers patched in January 2026.
So a proxy node is also an entry point into the network behind it. On a corporate or government network, that’s the part that should worry you most.
What to check, at work and at home
| Where | Signal or action | Why it helps |
|---|---|---|
| DNS logs | Look for queries to known residential-proxy domains | Infoblox found them across 65% of its customers |
| Egress monitoring | Persistent outbound beaconing from endpoints, especially in the evening | This matches the 5 p.m. to midnight pattern at AS2650 |
| Software inventory | Flag “free” apps that carry monetization SDKs, such as Infatica | Shows how employee devices bring proxies into the workplace |
| IoT inventory | Find off-brand Android devices: TV boxes, signage, kiosks | XCPE reached signage and telehealth devices |
| External exposure | Check proxy-intelligence feeds for exits from your own ASN | Layer3 found the White House exits through public services |
| Home | Check your box against Synthient’s list of affected models; if it’s listed, unplug it | A pre-infected device can’t be cleaned by the person who owns it |
For family members, in plain terms: be suspicious of any box that promises hundreds of pay-TV channels for a one-time fee. These boxes find buyers through influencers on TikTok and other social networks. Even MECOOL, which took off after a mention on Linus Tech Tips, turned out to be pre-infected. The channel has since reframed the video as a scam and removed its affiliate links. Antivirus won’t fix a device that came infected from the factory.
What to learn from this
- A source IP is not an identity. Thanks to residential proxies, a home, a hospital or the White House can all be rented exit points. Score requests using behavior, session and device signals, not reputation alone.
- Check whether your own network is for rent. Look for proxy-SDK DNS queries and steady outbound beaconing. Check proxy-intelligence sources for exits from your own ASN.
- Treat unmanaged Android IoT as untrusted. Put TV boxes, signage and kiosks on isolated segments. A proxy node can be used to reach other systems on the same network.
- Don’t rely on SDK “consent”. In the Oxylabs case, a consent flow existed and was faked by the supplier. Control what gets installed rather than trusting the vendor’s paperwork.
- Tell your family about the “too good to be true” box. A one-time fee for pirated channels is often paid for with their internet connection.