Residential proxy networks let attackers send credential stuffing, password spraying and fraud traffic through the home internet connections of unsuspecting people, so it looks like ordinary customers in the right country and defeats IP reputation and geo-blocking rules. These networks are built from infected computers, compromised routers and backdoored streaming boxes, then rented out. The FBI and US Department of Justice have described one such service, 911 S5, as spanning more than 19 million IP addresses. This guide explains how residential proxies work, where they appear in attacks, the impact, and how identity, fraud and SOC teams can detect and resist traffic that no longer looks suspicious by location. It is for identity engineers, fraud analysts, SOC teams and application owners running login and checkout flows. It complements the Botnets Guide.
Key takeaways
- The source IP no longer tells you who is attacking. Traffic leaves from real ISP-assigned home addresses, often in the same city as the account owner.
- Supply comes from compromised devices. Public cases involve malware bundled with free VPN apps, end-of-life routers and backdoored Android streaming devices.
- Low and slow sprays slip past thresholds. Microsoft observed one sign-in attempt per account per day in about 80 percent of cases from a covert router network.
- The defence is in the credential, not the IP. Phishing-resistant MFA, blocking legacy authentication and breached-password checks matter more than IP blocklists.
- Detect by behaviour across many accounts. Correlate failures across accounts, ISPs, devices and user agents rather than per IP.
How the attack works
A residential proxy service sells the ability to route traffic through someone else's home connection. The pieces are well documented by law enforcement.
- Build the pool: devices are compromised or enrolled without informed consent. DOJ says the 911 S5 operator spread malware through his own free VPN programs, MaskVPN and DewVPN, and through pay-per-install bundles with pirated software. The FBI describes end-of-life routers infected by TheMoon malware and BADBOX 2.0 backdoors preloaded on, or installed during setup of, TV streaming boxes, projectors, car infotainment units and picture frames.
- Sell access: the operator rents exit nodes to customers. DOJ says the 911 S5 administrator reportedly received about 99 million US dollars from sales between 2018 and July 2022.
- Route attack traffic: the customer chooses an exit country or city and sends requests through the proxy, often a SOCKS5 relay, so the target sees the victim household's address.
- Rotate: each request or session can exit from a different address, defeating rate limits per IP.
Proxy types compared
| Type | Where the exit IP lives | How defenders see it | Abuse risk |
|---|---|---|---|
| Datacentre proxy or VPS | Hosting provider ranges | Easy to classify by ASN; commonly blocked or challenged | High volume, easier to stop |
| Commercial VPN | Known VPN provider ranges | Usually listed by IP intelligence vendors | Moderate |
| Residential proxy (compromised devices) | Home broadband customers of ordinary ISPs | Looks like real customers; same ISPs as legitimate users | High, and the device owner is also a victim |
| Mobile proxy | Mobile carrier ranges behind carrier-grade NAT | Many legitimate users share each address, so blocking causes collateral damage | High |
| Covert router networks (state-linked) | Compromised SOHO routers | Residential-looking; used for targeted sprays | High for enterprises |
ATT&CK mapping
| Stage | Technique |
|---|---|
| Resource development | T1584.005 Botnet; T1584.008 Network Devices |
| Command and control and anonymisation | T1090.002 External Proxy; T1090.003 Multi-hop Proxy |
| Credential access | T1110.003 Password Spraying; T1110.004 Credential Stuffing |
| Initial access | T1078 Valid Accounts |
For the proxy technique in depth, see the T1090 Proxy Defensive Guide.
Where it shows up
- Password spraying against enterprises: Microsoft's October 2024 report describes CovertNetwork-1658, a network mostly of compromised TP-Link SOHO routers (also tracked as xlogin and Quad7) with about 8,000 active nodes at a time. Multiple Chinese threat actors use credentials it gathers, and Storm-0940 used them against think tanks, government bodies, law firms and the defence industrial base. See the Storm-0940 Password Spray Botnet Profile Guide.
- Credential stuffing against consumer services: reused passwords from other breaches are tried from residential exits so each attempt looks like a home user. See the Password Spraying and Credential Stuffing Defence Guide.
- Government benefit and payment fraud: DOJ says about 560,000 fraudulent unemployment insurance claims, with confirmed losses above 5.9 billion US dollars, and more than 47,000 Economic Injury Disaster Loan applications came from 911 S5 IP addresses.
- Retail and card fraud: DOJ cites about 2,525 fraudulent orders worth 5.5 million US dollars placed on the Army and Air Force Exchange Service platform through the service.
- Other crime: the FBI notes router proxies used to hide cryptocurrency theft; DOJ lists stalking, threats and child exploitation material among alleged uses of 911 S5.
- State operations: compromised home and small office devices also give nation-state actors deniable infrastructure; see the Mirai and IoT Botnet Families Guide.
Impact
- Controls lose a signal: geo-blocking, country allowlists and IP reputation stop working for attackers who can pick an exit in your customer's town.
- Account takeover at scale: rotating exits let stuffing and spraying stay below per-IP thresholds. The 23andMe breach shows how far reused-password logins can reach when MFA is optional and anomaly detection misses a spike.
- Fraud losses: the 911 S5 case alone involved billions in alleged benefit fraud.
- Collateral damage: blocking a residential or mobile address can lock out real customers who share it, and device owners can find their address blocklisted or linked to crimes they did not commit.
- Exposure inside your own network: a backdoored streaming box or old router on a home worker's network is an unmanaged device beside the corporate laptop.
Detection
Microsoft notes that the low per-account volume means alerts for many failures from one IP, or against one account, do not fire. Detection has to look across accounts and attributes.
| Signal | Data source | Why it works against residential proxies |
|---|---|---|
| Failed sign-ins spread across many accounts, countries and IPs from one ISP or ASN | Identity provider sign-in logs | Microsoft provides a hunting query for exactly this pattern |
| Many accounts attempted with the same client fingerprint or user agent | Web and identity logs, bot management | Proxies change IPs but tooling often keeps a stable fingerprint |
| Successful login from a new device and new IP immediately after a spray period | Identity protection risk signals | Catches the payoff even when the spray was invisible |
| Unfamiliar sign-in properties, atypical or impossible travel | Identity threat detection | Microsoft lists these among its Storm-0940 detections |
| Legacy authentication attempts | Sign-in logs by client app | Legacy protocols cannot enforce MFA and are favoured by sprays |
| Rising breached-password matches at login | Password protection or breached-credential service | Indicates stuffing lists in use |
| Home or branch devices with unexplained outbound traffic, overheating or changed settings | Network monitoring, router admin pages | FBI indicators that a device has been turned into a proxy |
Metrics
- Percentage of workforce and customer accounts protected by phishing-resistant MFA or passkeys.
- Number of sign-ins using legacy authentication (target: zero for workforce).
- Credential stuffing success rate: successful logins from detected stuffing sessions per thousand attempts.
- Mean time from spray detection to forced reset of targeted accounts.
- False positive rate of IP-based blocks on legitimate customers.
Prevention and hardening
Phased rollout
- Remove the easy wins (weeks 1 to 4): block legacy authentication, enforce MFA on all workforce accounts with no exclusions, and enable lockout features such as AD FS extranet lockout, as Microsoft recommends. Run conditional access policies in report-only mode first and keep a break-glass account excluded for rollback. See the Conditional Access Guide.
- Move to phishing-resistant methods: roll out passkeys or FIDO2 for administrators first, then all staff. For customers, offer passkeys and step-up MFA on risky logins. See the Passwordless and Passkeys Guide.
- Check passwords against breach corpora: reject known-breached passwords at registration and change, and prompt resets when a login uses one.
- Add behavioural bot defences to login and checkout: device fingerprinting, rate limits per account and per fingerprint, and challenges for automation. See the Bot Management Guide.
- Tune detections: deploy the cross-account analytics above in alert mode for two weeks before automating resets or blocks.
- Treat IP intelligence as a score, not a gate: feed residential proxy classifications into risk scoring alongside device and behaviour signals.
Decision guidance
- Block or challenge? Blocking datacentre ranges is low risk for consumer logins. Residential and mobile proxy addresses are shared with real users, so challenge or step up rather than block.
- Workforce versus customers: workforce identity can require managed devices and phishing-resistant MFA, which makes the source IP irrelevant. Customer identity has to balance friction, so risk-based step-up is the norm.
- Small organisations: MFA everywhere, legacy authentication off and breached-password checks give most of the protection without a fraud team.
- Large consumer platforms: invest in a fraud and bot analytics layer that clusters attempts across accounts and fingerprints.
Where identity fits
Residential proxies attack the assumption that network location says something about identity. Zero trust designs that authenticate the user and device on every request, rather than trusting geography, are the structural answer. Service accounts and API keys are exposed too: a leaked key used from a residential exit looks like a normal client, so bind non-human credentials to workload identity or source restrictions where the platform allows. See the Account Takeover Prevention Guide.
Reduce your contribution to the supply
- Replace end-of-life routers, apply firmware updates and disable remote administration, as the FBI advises, with unique random passwords of 16 to 64 characters.
- Ban unofficial app stores and uncertified Android streaming devices on networks used for work, following the FBI's BADBOX 2.0 indicators.
- Block free VPN and proxyware apps on managed endpoints.
Common failure patterns
- Relying on country blocks to stop credential stuffing.
- Alerting only on failures per IP or per account, which low and slow sprays never trip.
- Leaving legacy authentication enabled for one old application.
- Blocking whole mobile carrier ranges and locking out real customers.
- Treating MFA as optional for consumers, as in the 23andMe case.
Framework mapping
| Control | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 |
|---|---|---|
| MFA and phishing-resistant authentication | PR.AA-03 | IA-2 |
| Breached-password checks and lockout | PR.AA-01 | IA-5, AC-7 |
| Cross-account anomaly detection | DE.AE-02 | SI-4, AU-6 |
| Response to sprays | RS.MA-01 | IR-4 |
| Device hygiene (routers, IoT) | PR.PS-02 | SI-2, CM-7 |
Lessons from incidents
- 911 S5 (dismantled May 2024): one operator built a pool of more than 19 million IP addresses from free VPN apps and bundled software, showing that "residential" traffic can be industrial in scale. Fraud teams that relied on IP checks for benefit claims were bypassed.
- CovertNetwork-1658 (reported October 2024): a few thousand routers were enough to run enterprise sprays that Microsoft says evaded common alerts, and credentials were sometimes used the same day.
- 23andMe (2023): reused-password logins at scale succeed when MFA is optional and anomaly detection misses volume spikes, whatever the source IP.
Practitioner checklist
- Enforce MFA on every workforce account and move administrators to phishing-resistant methods.
- Block legacy authentication protocols.
- Reject breached passwords at set and change, and force resets when one is used.
- Correlate failed logins across accounts, ISPs, fingerprints and user agents, not just per IP.
- Use residential proxy intelligence as a risk score that triggers step-up, not as a hard block.
- Add behavioural bot defences to login, registration and checkout.
- Replace end-of-life routers and ban unofficial app stores and uncertified streaming devices on work networks.
- Rehearse a spray response: identify targeted accounts, reset, and review privileged ones first.
Standards and references
- US Department of Justice: 911 S5 Botnet Dismantled and Its Administrator Arrested in Coordinated International Operation
- FBI: Cyber Criminal Proxy Services Exploiting End of Life Routers
- FBI: Home Internet Connected Devices Facilitate Criminal Activity (BADBOX 2.0)
- Microsoft Threat Intelligence: Chinese threat actor Storm-0940 uses credentials from password spray attacks from a covert network
- MITRE ATT&CK: Proxy (T1090)
- MITRE ATT&CK: Brute Force: Credential Stuffing (T1110.004)
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: Password Spraying and Credential Stuffing Defence Guide · Bot Management Guide · Botnets Guide · Account Takeover Prevention Guide