Introduction
Congratulations on the bargain. You skipped the name-brand streamer, bought an unbranded "fully loaded" Android box for the price of a pizza, and saved enough for a decent lunch. The box is now earning its keep. It just isn't paying you.
Some cheap Android TV boxes ship with malware already inside: a backdoor that rents your home internet connection to strangers. Once the box is online, your household's IP address works as an exit for a residential proxy network: other people's traffic leaves the internet from your living room, and every site on the receiving end blames your address. The FBI warned about exactly this in June 2025 under the name BADBOX 2.0. Google sued the operators a month later, and in 2026 it went after the proxy services that sell the stolen bandwidth.
Nobody tells you directly. You notice the side effects: a captcha on every search, Google's "unusual traffic" page, a bank that suddenly wants extra proof you are you. A website can check whether your address has a record. It cannot see which device in your home earned it, so the box itself is something you have to look at.
What Is a Residential Proxy, in One Paragraph
A residential proxy network sells the right to route traffic through IP addresses that internet providers assign to homes and small businesses. Customers want those addresses because websites trust a home line far more than a datacenter, so a scraper, a fake-account farm or a credential-stuffing script hidden behind thousands of living rooms looks like thousands of ordinary people. The exits, called exit nodes, are real consumer devices. Google's threat intelligence group describes how they get there. Some devices come pre-loaded with proxy software. Some owners install a trojanized app with proxy code hidden inside. Others install the software on purpose, lured by a promise to "monetize" spare bandwidth. The no-name TV box takes the first route, and nobody asked your permission, because the box never had a terms-of-service screen for this part. How a residential proxy differs from a VPN or Tor for the person using it is explained in VPN vs Proxy vs Tor.
How a Cheap Box Ends Up Working for Someone Else
BADBOX 2.0: the backdoor comes in the box
HUMAN's Satori threat intelligence team exposed BADBOX 2.0 in March 2025. It found the backdoor arriving three ways: pre-installed on the device, downloaded from a command server the first time the device boots, or packed into re-bundled copies of popular apps on third-party app stores. The targets were low-cost, off-brand devices running the Android Open Source Project without Google's certification: TV boxes, tablets, digital projectors and aftermarket car infotainment units.
The FBI's public service announcement of June 2025 says the same thing in plainer words. Criminals either configure the product with malicious software before you buy it, or the device gets infected while it downloads the apps it needs during setup. In both cases the infected device can become part of the BADBOX 2.0 botnet and of "residential proxy services known to be used for malicious activity".
Once the backdoor runs, it fetches whatever module the operators feel like selling. HUMAN found programmatic ad fraud, click fraud and residential proxy service. The proxy service then lets whoever buys access run account takeover, fake account creation, DDoS, malware distribution and one-time password theft through your living room. One group behind the operation ran its own storefront that sold the infected boxes as proxy exits.
In July 2025 Google filed suit in New York federal court against the people behind what it called "the largest known botnet of internet-connected TVs", and updated Google Play Protect to block BadBox-associated apps. Lovely, if your box runs Play Protect. The boxes at the center of BADBOX 2.0 are uncertified, and Google's own Play Protect help page says Google apps on uncertified devices "aren't licensed and aren't real Google apps". The lawsuit does not reach into your TV cabinet and uninstall anything.
Kimwolf: the proxy becomes a door into your network
Kimwolf is an Android botnet aimed mostly at TV boxes and set-top boxes, disclosed by QiAnXin's XLab in December 2025. It launches DDoS attacks and relays proxy traffic, and it spreads in a way every owner of a cheap box should know about. In Palo Alto Networks Unit 42's words, "Kimwolf spreads by misusing residential proxy services to reach unauthenticated Android Debug Bridge (ADB) instances on local networks." ADB is Android's developer debugging interface, and Unit 42 notes that some Android TV boxes ship with it switched on at port 5555, no password required.
Put together, that works like this. One device in your home is a proxy exit. A stranger rents it, and the proxy forwards the request to an address inside your home network, where any box with an open debug port accepts a new app without asking. You started with one infected device and now have two.
Google's threat intelligence group named Kimwolf, Aisuru and BADBOX 2.0 among the botnets tied to IPIDEA, the residential proxy network it disrupted in January 2026. In July 2026 it took action against a second network, NetNut, and wrote that NetNut recruits devices with SDKs "for devices commonly found in homes, such as smart TVs and streaming boxes." The same post spells out the risk to the owner: when a device becomes an exit node, outsiders can reach other private devices on the same home network.
Why a Proxy Exit Wrecks Your Household's IP Reputation
Behind a home router, every device shares one public IPv4 address. From outside, the TV box, your laptop and your phone are the same address. So when a proxy customer pushes stolen passwords into login forms, scrapes a shop or clicks ads through the box, the target logs your address, and the anti-fraud systems that learn from those logs learn that your address misbehaves.
That is how IP reputation works, and it is collective punishment by design. A site cannot see which device behind your router did it, so the whole household pays. The mechanics of clean and toxic addresses are covered in IP Reputation: Clean vs Toxic, and why the punishment so often takes the form of endless puzzles is in The Captcha Trap.
Spamhaus says so directly. Its Exploits Blocklist is a realtime list of addresses used by hijacked devices, it names "free VPN" apps that turn the customer's device into a proxy as one cause, and it re-lists an address while infected devices behind it stay active. Google's help page for the "unusual traffic from your computer network" message opens its list of causes with "You or another user on your network might have malware". And Google's residential proxy posts warn that owners of exit nodes can have their legitimate traffic flagged as suspicious or blocked.
Three details make the picture messier than "my IP is dirty":
- IPv6 splits the blame only sometimes. With IPv6, each device usually gets its own public address, so a list that records single addresses can flag the box and leave your laptop looking clean. Spamhaus lists IPv6 by the block, and the block it uses (a /64) is the one every device on a typical home network shares. Your IPv4 address is shared by everything at home either way.
- Carrier-grade NAT is per neighborhood. Some providers put many customers behind one public IPv4 address. Then a listing can come from a neighbor's box, and yours can hurt them.
- Not every list is an accusation. Spamhaus also runs a Policy Blocklist of ordinary home address ranges that should not send email straight to mail servers. Spamhaus says the addresses there are not necessarily bad. Seeing your home IP on it says nothing about your TV box.
How to Tell If Your Android TV Box Is Infected
Some signs are visible on the box before it ever goes online. The FBI lists them as indicators. Others show up on your network or in how sites treat you, and those are weaker one by one but strong together.
| Sign | What it points to | How much it tells you |
|---|---|---|
| No recognizable brand, sold as "unlocked" or with free channels | Both are on the FBI's list of BADBOX 2.0 indicators. | Strong. Treat the box as suspect from day one. |
| Not Play Protect certified, or setup asks you to turn Play Protect off | An uncertified Android build, the kind HUMAN found carrying the backdoor. | Strong. |
| Apps come from a store other than Google Play | The third delivery route for the backdoor: re-bundled copies of popular apps. | Medium. |
| The box sends traffic while nothing is playing | "Unexplained or suspicious Internet traffic", in the FBI's words. A streamer has no reason to upload steadily at 3 a.m. | The strongest sign you can see at home. |
| Captchas everywhere, Google's "unusual traffic" page | Something is generating automated traffic from your address, or from a shared address you sit behind. | Weak on its own. VPNs and carrier-grade NAT cause it too. |
| Sites challenge every device at home, but not your phone on mobile data | The problem is the address, not one browser. | Medium. |
| An abuse notice from your internet provider | Someone reported attacks or scanning from your address. | Strong. Take it seriously. |
The traffic check needs no special tools: many home routers, or their apps, list connected devices with per-device traffic counters. A box that idles all night while its upload counter keeps climbing is working for somebody, and it is not you.
How to Check Whether Your Home IP Is Flagged
No website can see inside your home, so nobody can answer "is my IP part of a residential proxy network" from outside. What can be checked is whether your address has collected abuse listings, which is what anti-fraud systems hold against you.
The IP Reputation card of the Privacy & Trust Index looks at the address your browser connected from and answers two questions. First, what kind of connection it is: a home or business line, a VPN, Tor, a datacenter, or a consumer relay such as iCloud Private Relay or Cloudflare WARP. Second, whether the address appears in public abuse and threat databases, the kind of records anti-fraud systems lean on.
A clean home line shows RESIDENTIAL ISP in green with the line "Not listed in any abuse or threat database". A listed address turns the card red with the status BLACKLISTED and pulls the Trust score down hard. For a home IP, the card's advice is to scan your network for malware and request delisting.
Read the result with three rules in mind:
- Run it from home with the VPN off. With a VPN on, the card judges the VPN's exit address, which tells you nothing about your TV box. If your home line has both IPv4 and IPv6, the card judges the address the page arrived over, which the Network Details section marks as "this connection". If that is your IPv6 address, the verdict is about that one address. Your household shares the IPv4 address, and that is the one abuse lists record most often, so a green result over IPv6 is weak evidence.
- Green does not clear the box. The card sees your address from outside and knows only what the lists recorded. An exit node used for quiet scraping or ad clicks may never earn a listing. The box can be guilty while the address still looks clean.
- Red does not convict the box. On carrier-grade NAT the listing may belong to a neighbor, and a dynamic address can carry a history from its previous holder. The Whois lookup shows which provider and network block the address belongs to, which helps when you contact that provider.
The same card also has a POSSIBLE RESIDENTIAL PROXY verdict for the opposite case: a visitor who arrives through somebody else's home device. It appears when an address looks like an ordinary home line but other parts of the same connection do not fit with it. It will not fire just because your TV box is an exit, since your laptop still goes out directly. The strangers renting your box are the ones who face checks like this.
What to Do If Your TV Box Is Infected
Take the box off the network first. The FBI recommends disconnecting devices that show these indicators. Pull the cable, remove it from the Wi-Fi, and see whether the captchas and the idle-hour traffic stop.
Do not count on a factory reset. A reset returns the box to its factory image. If the backdoor shipped in that image, it comes back with the reset, and if it arrived through the first-boot download, the box fetches it again on the next boot. Synthient, one of the firms that tracked Kimwolf, advises that infected boxes be wiped or destroyed, as BleepingComputer reported. For a box that cost less than a pair of sneakers, the bin wins on time alone.
Replace it with a certified device. If you want an Android TV box that is far less likely to ship with malware, Play Protect certification is the signal to look for. Google's advice after the IPIDEA takedown is to buy connected devices from reputable manufacturers and to check the Android TV site's list of Play Protect certified partners, and its Play Protect help page warns that uncertified devices may not get Android system or app updates. A no-name box gets whatever its firmware vendor decided to sell.
Then check the rest of your network. Kimwolf reached devices inside homes through proxy exits, so the box may not be the only problem. Look at every other no-name gadget on the network, such as projectors and photo frames, and check every Android TV device for developer or network debugging. Turn it off even if you never switched it on, because some boxes ship with it enabled. Remove apps that pay you to share bandwidth and free VPN apps of unknown origin. Google calls bandwidth-sharing apps a primary way proxy networks grow, and Spamhaus names free VPN apps among the causes of its listings.
Give cheap gadgets their own network. Most home routers can run a guest network. Put smart TVs, boxes and other gadgets there, ideally with client isolation on, so a compromised device cannot reach your laptops and phones.
Clean up the address last, once the box is gone, because an address re-lists as soon as the problem shows up again. Spamhaus says its Exploits Blocklist entries expire on their own when the behavior stops, and it handles removals through its public reputation checker. On a dynamic connection, reconnecting the router or asking your provider can get you a fresh address, though some providers keep the same one for months. Then run the scan again.
Finally, report it. The FBI asks anyone who believes they were the victim of an intrusion to file a report with its Internet Crime Complaint Center.
A cheap box costs you twice: once at checkout, and again in captchas, blocks and bandwidth lent to people you would never let through the front door. You pay for security one way or the other, and paying upfront is cheaper.
FAQ
Q: Is my IP being used as a residential proxy?
A: No outside test can say for certain that your IP is part of a residential proxy network or a botnet, because nobody outside your home sees which device sends what. Check two things: in your router, a device sending traffic while idle; and from outside, whether your address sits in abuse databases, which the IP Reputation card of the Privacy & Trust Index shows when run from home with the VPN off.
Q: What is BADBOX 2.0?
A: A botnet of cheap, uncertified Android devices, mostly TV boxes, tablets and projectors, exposed by HUMAN in March 2025. The FBI warned about it in June 2025 and Google sued its operators in July. Infected devices can serve as residential proxy exits.
Q: What is the Kimwolf botnet?
A: An Android botnet of mostly TV boxes and set-top boxes, disclosed by XLab in December 2025, used for DDoS attacks and proxy traffic. It spreads through residential proxy exits into home networks and installs itself on devices that leave Android's debugging interface open.
Q: How do I know if my Android TV box has malware or a virus?
A: Start with the FBI's indicators: no recognizable brand, marketing about free or "unlocked" content, no Play Protect certification, setup that asks you to disable Play Protect, and apps from unofficial stores. Then watch the box's traffic in your router: steady uploads while nothing is playing are the clearest sign you can see at home.
Q: Does a factory reset remove Android TV box malware?
A: Often not, and that includes BADBOX 2.0. When the backdoor ships in the firmware, a reset restores it, and a box that downloads its malware on first boot fetches it again. Replacing the box with a Play Protect certified device is the reliable fix.
Q: How do I check for Kimwolf?
A: Look for the same signs as any infected box, and make sure no Android device at home has developer or network debugging switched on, since that open door is how Kimwolf moves from one device to the next. BleepingComputer reported that Synthient, one of the firms that tracked Kimwolf, published an online scanner to help you find out whether any device on your network is part of the Kimwolf botnet.
Q: Why is my IP blacklisted when I did nothing wrong?
A: A blocklist records an address, and every device at home shares one public IPv4 address, so traffic from an infected box or app counts against the whole household. On carrier-grade NAT the listing can even come from another customer's device. IP Reputation: Clean vs Toxic explains how those histories build up.
Sources
- Home Internet Connected Devices Facilitate Criminal Activity, FBI public service announcement I-060525-PSA, June 2025.
- BADBOX 2.0 Targets Consumer Devices with Multiple Fraud Schemes, HUMAN Satori Threat Intelligence, March 2025.
- Disrupting the largest residential proxy network, Google Threat Intelligence Group, January 2026.
- Google's Continued Disruption of Malicious Residential Proxy Networks, Google Threat Intelligence Group, July 2026.
- Kimwolf v7: An Evolution of the Kimwolf Botnet, Palo Alto Networks Unit 42.
Is your home address already paying for someone else's traffic?
Run the Privacy & Trust Index check from home with the VPN off and open the IP Reputation card to see whether your address sits in public abuse databases.