On this page
On November 2, Google's Threat Intelligence Group said it had dismantled XCPE the week before: a backdoor that Videostrong, an Android device maker, built into more than 1.3 million TV set-top boxes, mostly to load residential proxy software. Google says taking down its affiliates' command domains "will sever access to at least 10 million additional compromised devices".
We count the other side of that market: the exits residential proxy networks rent out. Across the 89 networks we saw on every day from October 12 to November 6, the five days from Google's announcement averaged 4.21 million IPv4 exit addresses a day, 2.4% fewer than the week before the takedown. The count had been falling by 1.1% to 1.4% a week since mid-October, and the takedown week didn't change that pace.
XCPE and BadBox 2.0
Google's write-up describes three stages. A stub called x.cpe ships in the firmware and reinstalls itself if removed. It takes orders from Videostrong's servers and hands them to a loader, which runs modules from affiliates who bought access to the boxes. Most were residential proxy software, which turns a box into an exit that a proxy network rents out to its customers. Among them Google names Linkfog, AppSalt (Honeygain's), GaGaNode, NetNut's Popanet, Traffmonetizer and EarnFM, and it found as many as three proxy modules on a single box. Others did ad fraud.
Two of the modules, Moyu and Bird, are backdoors that Google says were previously tied to BadBox, and Videostrong moved its modules out of x.cpe in late 2024, "possibly as a response to earlier Google enforcement related to BadBox". The FBI warned in June 2025 that the BadBox 2.0 botnet "consists of millions of infected devices", with backdoors to proxy services.
Google took legal action against Videostrong's domains and servers and against the command domains of over a dozen module families, and banned Videostrong from building certified Android devices. CyberScoop reported, citing TrendAI's researchers, that the infected boxes were concentrated in Malaysia, Brazil, Iraq, Mexico and Taiwan, with nearly 44,000 in the United States between June and October. Google also called the market behind them resilient: "when one component is disrupted, operators quickly pivot to new loaders or rival monetization SDKs."
Exits a day, before and after
Each point is the number of distinct IPv4 addresses we saw exiting those 89 networks that UTC day. The dashed lines are each week's average.
The weekly average fell 1.4%, then 1.1% over the takedown week, then 1.3% to the five days from November 2 to 6.
One more network was seen on every day too. Its daily count stepped up on October 26 and stayed up, a change big enough to set the total on its own, so it's left out of the figures here. Counted in, November 2 to 6 averaged 2.3% more exits a day than October 19 to 25.
The five countries
Each address is placed in a country with IP Country. The average exits a day in the five countries TrendAI named, and the United States:
| Country | Oct 12 to 18 | Oct 19 to 25 | Nov 2 to 6 | Change from Oct 19 to 25 |
|---|---|---|---|---|
| Brazil | 580,749 | 584,916 | 566,496 | -3.1% |
| Mexico | 92,391 | 91,572 | 91,022 | -0.6% |
| Iraq | 48,995 | 51,596 | 54,854 | +6.3% |
| Malaysia | 32,714 | 36,104 | 30,306 | -16.1% |
| Taiwan | 13,456 | 16,014 | 15,170 | -5.3% |
| United States | 463,458 | 458,500 | 453,263 | -1.1% |
What to do with it
- A takedown headline is no reason to relax a proxy check. In the five days after Google's announcement, daily exits across the networks we saw fell no faster than before it.
- Check against a list that's at most a day old. When we measured staleness on September 27, a 30-day list from the day before held 86.5% of that day's IPv4 exits, and the same list a week old held 76.3%.
How we counted
- Every IPv4 address we saw exiting a residential proxy network, counted once a UTC day, from October 12 to November 6, 2026. IPv6 is not included.
- The networks are the 89 we saw on every one of those 26 days, so a network that started or stopped appearing in that span can't move the count. The one network whose count stepped up on October 26 is left out, as above.
- Countries are from IP Country's November 7 build.
- Before is October 19 to 25, the week ahead of the takedown week. After is November 2 to 6, from Google's announcement to the last full day before we counted.
Getting access
Residential Proxy IP ships each address with the provider that sold it and how often it appeared, rebuilt daily in windows from 1 day to 90. It has no sample: talk to us to evaluate it, and see pricing. IP Country is free with an account.
