The modern attack surface is not confined to corporate infrastructure. Sometimes it looks like a cheap streaming box, a passive-income bandwidth app, or a neglected home device sitting quietly on a residential network.
That is the backdrop for a new report from the Digital Citizens Alliance, supported by risk3sixty’s Armada team, that looks at residential proxy networks and the way illicit actors turn ordinary household internet connections into operational cover. From Armada’s side, this is the kind of problem that gets our attention fast. It sits at the intersection of exposure, infrastructure abuse, and adversary tradecraft. It also scales far beyond what most people think is happening inside home networks.
The mechanics are simple enough to describe. An internet-connected device or service gives an outside party a foothold into residential IP space. That IP then becomes useful because it looks benign. Instead of operating from obviously hostile infrastructure, an actor can route traffic through what appears to be an ordinary American household.
According to the report, investigators found millions of U.S. IP connections feeding this ecosystem. They also found that a large share of the proxy connections examined carried fraud indicators, suggesting repeated criminal use.
Nearly half of the roughly 26 million residential IPs tracked over 30 days appeared across multiple proxy providers, which means once a connection enters this market, it does not necessarily stay contained to one service.
One of the reasons Armada was involved is because this is a threat exposure story. The same way we think about internet-facing assets, shadow IT, or exploitable weaknesses, this report looks at what happens when ordinary connectivity becomes an attack surface that someone else can operationalize. This can mean:
That last point is very important. Good adversaries want access and cover, and residential proxies offer both.
The report includes examples that make the issue more concrete, including streaming devices that connected to infrastructure in China and received remote commands, as well as bandwidth-sharing scenarios where observed traffic involved entities in China and Russia. It also found proxy listings and guides on dark web markets, reinforcing that this is a market, and markets mature when they work.
From Armada’s perspective, the technical takeaway is straightforward. If defenders only think in terms of traditional malicious infrastructure, they are already behind. Adversaries adapt to trust assumptions. Residential IP space carries built-in trust in many environments, and that is exactly why it has value.
Our team’s role from the risk3sixty side was to help bring investigative depth to a problem that often gets talked about in abstract terms. Residential proxies are not abstract. They are operationally useful to bad actors, difficult for ordinary consumers to see, and increasingly relevant to anyone responsible for security, fraud, trust, or enforcement.
At Armada, we spend our time validating what is real, what is exploitable, and what defenders are likely to miss if they only watch the obvious places. This report fits squarely in that lane.
If you have questions about the report or want to learn more about risk3sixty’s Armada team, reach out and connect with us.