"residential proxy network" is what you call a botnet when it's run by a corporation that will never be prosecuted for doing something that would land a 13 year old in jail for the rest of their life
Aug 1, 2026, 1:22 AM@mattly probably a good sign that i searched "residential proxy network" and the first result was an FBI article on how to keep yourself safe from being used as part of one, right? :neocat_laugh_nervous:
Aug 1, 2026, 1:31 AM
@mattly why/how are they allowed?
@sammypanda @mattly because they have money and law is for sale.
@beeoproblem @sammypanda @mattly Those things are the plague. Websites are hit by continuous scraping from a huge number of domestic IP addresses. This creates errors, causes slowdown, and is nearly impossible to block.
@mike805 @beeoproblem @mattly yeah and it's weird traffic too in my experience, like stuff that immediately makes me think its a bot. It's also very often mobile internet.
Aug 1, 2026, 1:46 PM@sammypanda @mike805 @beeoproblem @mattly that's because these botnet companies develop and publish "SDKs" that mobile app developers, especially of 'free' apps, are paid pennies to integrate into their apps in the same way that they integrate advertising (and now often integrate both)
Aug 1, 2026, 1:47 PM@sammypanda @mike805 @beeoproblem @mattly so basically that 'free app' off the play store may quite possibly be ddosing websites on behalf of an "ai" company
Aug 3, 2026, 2:07 PM@joepie91
Yeah, I regularily receive “partnership offers” for some (mostly desktop) software I develop too. They just scrape the download stats and contact info, then send me messages how “much” money I could make based on that.
I really hope we never become desperate enough for me to seriously consider accepting. But since we have no income to speak off...
@sammypanda @mike805 @beeoproblem
@curiousicae @joepie91 @sammypanda @beeoproblem Here's my project that isn't making me any money: https://TheUnCloud.co/ video, screen sharing, file transfer and chat without cloud storage. Uses WebRTC so it's not costing me much either, and it has no commercial malware.
@mike805 @beeoproblem @sammypanda @mattly "have you heard about my today's sponsor *VPN? "
@alesroubicek @beeoproblem @sammypanda @mattly I'd like to see the residential ISPs detect this sort of thing and throttle the customers to about 56K until they remove whatever is hosting the malware.
Either that or there needs to be a Spamhaus-like blocking service so the customers are denied access to pretty much everything. Put the problem back on the fool who is running a Kodi box (or a Walmart special TV, not much difference.)
Have you found a good way to block this stuff?
@mike805 @beeoproblem @sammypanda @mattly I didn't, I have my sites behind CDN and hope they have the capital to deal with it.
Aug 1, 2026, 7:00 AM@mike805 if you find it useful, I use go-away (https://git.gammaspectra.live/git/go-away), rules ramped up for checks on blog posts that usually cans out the bots. On the firewall I also pull a blocklist from AbuseIPDB.com, for the most part it will catch scrapers in the net.
I've not yet worked out a way to calculate failed challenges for an IP then report them in to AbuseIPDB from go-away to rat on them
@mike805 Do you you have a reference how Kodi is affected by this botnet/proxy topic?
@6N3my6 https://www.kaspersky.com/blog/android-tv-botnet/55799/
https://www.eff.org/deeplinks/2026/06/primed-malware-stop-selling-compromised-android-devices
Kodi itself is fine, but the packages installed on those TV boxes are not.
@mike805 Thank you, interesting topic. But no mentions of Kodi in your links.
@6N3my6 These TV boxes almost all use Kodi as the basic user interface, and are sometimes generically called "Kodi boxes." They are generic Android platforms that often come preloaded with (or download on first use) a bunch of pirate streaming apps. Many of them also come preloaded with residential proxy malware.
No insult to Kodi as a project intended.
@mike805 Now that makes it clear to me, thank you. Wasn't aware some of these pre-configured boxes are based on Kodi.
@mike805 @alesroubicek @beeoproblem @mattly absolutely! my shower thought was how ISPs are majorly guilty for the issue. Bad oversight, ISP culture that doesn't care about IP reputation for some reason, CGNAT and anything else that allows IPs to be so ephemeral when they were really supposed to be... an address to you, but now they might as well just be considered purely for routing having been all been rentified. Also IANA doing nothing too. Without proactiveness on the issue IPv6 will be used exactly like this enshitifed IPv4 and that would be catastrophic.. an unbelievable amount of IPs to just cycle around and be careless with. It should be a way bigger concern for IANA, ISPs and governments that IPs are not doing what is on the can by the person they are rented to. There should be something to indicate that traffic is behind a proxy, something like the ISP/router could put a proxied traffic likely flag if there is incoming connections that match the volume of outgoing from the local ip it's assigned to + ways to prove that pattern is something other than a proxy if the user doesn't want the mark on their outgoing. But, there is really barely anything like that in the core design, it's all still pretending like there's only 1000 people on the internet lol; deferring all the reputation and usability of the internet to downstream services $$$, dynamic lists, cloudflare: lord of the modern internet, and the application layer. Rant +1
@alesroubicek @mike805 @beeoproblem @mattly oooh i didnt even think, i was thinking dodgy mobile apps and such.. of course commercial VPNs; that is so twisted cuz you'd think as a user that this is when your IP is *not* being used. But these somewhat have excuses for all the proxy related libraries.
Aug 1, 2026, 6:53 AM@mike805 right ! I've been watching my logs on my frontend, when a LLM scraper is blocked by my server trying to rip a blog post, as soon as it gets dropped or a 403 out of nowhere at least five retail IPs will come at it. Always a blog post from 2006 that has zero views, so not like it has something legit
Aug 1, 2026, 6:59 AMAug 1, 2026, 7:07 AM@ln yep, getting the rules right is a little bit of trial and error so the initial start will need a decent amount of time.
Otherwise you'll either be letting bots slip through or blocking people. Having a tarpit helps as well to feed a custom list of IPs to be dropped
@beeoproblem @sammypanda @mattly it's because you agreed to it in those terms of services you didn't read.
@bhhaskin @beeoproblem @mattly it's kinda like that is what they hope for
Aug 1, 2026, 1:48 PM@bhhaskin @beeoproblem @sammypanda @mattly not really. script kiddies have tried the same thing and gotten prosecuted anyway, and terms of service sure don't make you legally immune from ddosing websites (but having a lot of money sure does)
@joepie91 @beeoproblem @sammypanda @mattly intent matters with regards to the law. DDOS is a malicious action and the intent is clear. Crawling a website is not. Even if the crawling code is shitty and overloads the site the intention isn't to bring down or cause harm. If you want to add another layer of complexity, running and selling a residential proxy network is not malicious if you have permission from the host network. And of course as long as you don't know that the end users of the proxy network are doing anything malicious.
@bhhaskin @joepie91 @beeoproblem @mattly does getting abuse reports and still not fixing your crawler from causing problems count as an issue legally though?
i really do think there just needs to be a "if you bring down a site you were being negligent" standard made
Aug 1, 2026, 9:55 PM@bhhaskin @beeoproblem @sammypanda @mattly if this were true even in the US, then the whole thing with aaron swartz would've never happened
and operators know, they've always known, and this isn't exactly a secret
Aug 1, 2026, 6:48 AM@beeoproblem it's giving "the lords are anointed by god so whatever they do is fine" while they just yeet the peasants into the oubliette for looking at a sandwich wrong in a supermarket
@mattly this is a bad take. There are plenty of ethical proxies and proxies need to be protected to safeguard our online freedoms.
IP addresses are already used incorrectly as identification which ipv4 is fundamentally incapable of due to limited address pool making people share same 'indentity" and ipv6 adoption is artificially limited because it's harder to use for tracking so residential proxies are important in this ecosystem to get around IP identity based censorship.
@NosirrahSec @wraptile this
Aug 2, 2026, 3:57 AM@zuthal @wraptile @mattly another issue with residential proxies is that most people don’t use network segmentation at home so the proxy effectively gains access to the whole home network and its devices. Also typical home networks these days are more than just a router and a couple of computers like it used to be two decades ago.
@mattly the vast majority of modern software is just straight up malware with a ToS and marketing budget.
Aug 1, 2026, 6:25 PM
@d1 @womble @mattly oh yes they will. I've abandoned the smartphone and all "appy" thingies, windows, etc, and would be willing to actually disable the internet itself if this gets too dodgy and adversarial. I won't spend the next decades of my life fighting and analyzing and checking and rechecking software to catch every attempt to violate my privacy, ill simply disconnect. Full stop. I've been in tech close to 40 years, and disconnecting sounds... idyllic by now.
Aug 2, 2026, 8:42 PM@jbrownesq @womble @mattly Here's a poll to gain a sense of this, please "vote"!
https://autistics.life/@d1/117027851794657150
Aug 1, 2026, 5:12 AM@NosirrahSec @mattly I can't help but think that companies realized that ethical guidelines are fake at the same time that bully countries realized that international law is fake. This all comes from a lack of enforcement; when there are obviously no consequences, "ethics" won't restrain the powerful very long.
All that tells me is that we urgently need to bring consequences back.
Aug 1, 2026, 7:54 PM@mattly@hachyderm.io @NosirrahSec@infosec.exchange @ska@treehouse.systems start chopping fingers of ceo's
Aug 2, 2026, 2:53 PM@ska @NosirrahSec @mattly the purpose of a system is what it does 😔
Laws, too. Don't forget they're also breaking decades old laws like the US federal CFAA.
@NosirrahSec @mattly
@mattly oops, looks like thats why only poor people commit crimes
@mattly Countdown to residential routers having a "TV" port. Not for real-time QoS, but for locked down firewall of egress traffic.
@mattly This really should be made easier. I, uh, don't use residential grade routers. And tinkering with a particular vendors "security" cameras I made sure they couldn't get out from their own closed network.
Aug 1, 2026, 8:12 AMAug 1, 2026, 1:49 PMAug 1, 2026, 1:50 PM
Aug 1, 2026, 1:57 PMAug 1, 2026, 2:01 PM