Where residential proxy IPs come from

A residential proxy sends your request out through someone's home internet connection. The provider has to get that connection from somewhere, and buyers rarely see how.

Four ways providers get residential IPs

1. SDKs inside other apps. App developers add a provider's software kit to a free app or game and get paid for each active user. Whether the user knows their connection is resold depends on the app.
2. Bandwidth-sharing apps. People install an app that pays them to share their connection, usually cents per GB.
3. Deals with internet providers. ISP (static residential) proxies use address ranges registered to consumer ISPs and run on servers. No one's home connection is involved.
4. Malware and hijacked devices. Some networks grow through software installed without the owner's knowledge: trojanized apps, cheap TV boxes that ship with proxy software, hacked servers.

How some providers describe their own sourcing:

• Bright Data: Opt-in Bright SDK in partner apps (users get an ad-free or free app) and Bright Data's own apps such as EarnApp (users are paid); users can opt out at any time.
• Oxylabs: Residential IPs come mainly from the Honeygain and Bixberry bandwidth-sharing apps, whose users opt in and are paid, plus other application partners and ISPs.
• PacketStream: Peer-to-peer network of users who run the PacketStream desktop app and are paid $0.10 per GB routed through their connection.
• Proxyrack: Residential IPs come from its opt-in Peer program: users install the Peer app (Windows, Linux or Android) and are paid $0.50 per GB of traffic used on their residential IP.

What investigators found in 2026

In January 2026 Google's Threat Intelligence Group took legal action to take down domains used by IPIDEA, which it described as one of the largest residential proxy networks. Google said IPIDEA's SDKs enrolled devices through more than 600 Android apps and over 3,000 Windows programs, some disguised as system tools, and that its software helped build the BadBox 2.0, Aisuru and Kimwolf botnets. It named 13 proxy and VPN brands run by the same operators, among them 922 Proxy, ABC Proxy, IP 2 World, Luna Proxy and PY Proxy. (Google)

In July 2026 the FBI seized the domains of NetNut, a residential proxy service that researchers had tied to Popa, a botnet of more than two million devices, including unbranded Android TV boxes. (Krebs on Security)

Networks built on consent get abused too. Security firms keep finding attackers who break into servers and network devices and install legitimate bandwidth-sharing apps on them to earn money, which is called proxyjacking. (AhnLab, GreyNoise)

How we handle it

• Every provider page shows what the provider says about its sourcing. 64 of the 75 providers we list say something about it.
• Reports from security researchers and established news outlets are listed on the provider's page with links, and the provider gets a ⚠ in rankings. A report doesn't change where a provider ranks. Today 9 providers carry one: Asocks, Infatica, IPRoyal, Novada, PacketStream, Proxyrack, Shifter, SOAX and Thordata.
• A provider that a government, a court or a platform's threat-intelligence team names as part of a botnet is listed but not ranked: IP2World and PyProxy.

The reports differ a lot. Some describe a provider's own network enrolling devices without consent; others describe attackers installing a provider's legitimate app on hacked machines. Read them before you decide.

What to ask a provider

• Where do your residential IPs come from, and through which apps or SDKs?
• Do the people whose connections you resell know about it, and are they paid?
• Do you check who your customers are?
• What happens when you find a hijacked device in the pool?

Our methodology has the rules we follow, and the proxy types guide covers the alternatives to residential IPs.