Proxyjacking, measured: which devices sit on proxy exits

On October 15, GreyNoise described a campaign that broke into at least 143 devices in 34 countries to install Pawns.app without their owners' consent (GreyNoise). Pawns.app is proxyware: it sells the device's connection as a residential proxy. The targets were D-Link ShareCenter NAS boxes (CVE-2024-3272 and CVE-2024-3273), Ubiquiti UniFi Video recorders (Log4Shell) and SAP NetWeaver, with Hikvision and Dahua recorders tried as well. It's proxyjacking at a small scale. SocksEscort, which Europol says compromised more than 369,000 routers and IoT devices in 163 countries, was disrupted by Europol and its partners in March 2026 (Europol), and Anyproxy and 5Socks sold older routers as proxies until their domains were seized in May 2025 (US DOJ). Proxyware also ships preinstalled: in late October Google took down XCPE, a backdoor built into the firmware of more than 1.3 million Android TV boxes to load it, and the exits a day we counted fell no faster after the takedown than before.

None of them says which devices end up on residential proxy exits across the internet, which is a question we can put to our own data. Web IP holds the hosts answering on port 443 or 80, with each one's page title and Server header. Its November 2 build, of hosts last seen between October 6 and 25, held about 14.8 million IPv4 addresses on ISP networks, and 3.8% of them were residential proxy exits in Residential Proxy IP's 90-day list to November 2.

Each device against its own networks

Proxy exits cluster by network, so a device's raw share says as much about its ISPs as about the device. A network here is an origin AS, and each device family is set against the other addresses Web IP holds on its own networks: its expected matches are, network by network, its addresses times the exit rate of those other addresses. The last column is its matches over that.

The ISP's router is mostly the network

ISP-issued gateways, the fiber ONTs and DSL modems an ISP hands each subscriber, sat on proxy exits at 19.8% of their addresses, five times the 3.8% across ISP networks. The rest of their networks predicted more than three in four of those exits: against the other addresses there, ZTE's models were at 1.04x to 1.2x, and the boxes titled GPON Home Gateway at 1.6x. One ZTE model, the H8102E, sat on exits at 43.4% of its 22,653 addresses, made up 28% of the addresses on its three networks, and was at 1.04x. So a count of which gateways sit on exits mostly counts which ISPs' customers do.

The devices above their networks' rate

WindWeb/1.0 is Wind River's embedded web server for VxWorks, and these hosts' pages carry no title, so their makers aren't known. Their 563 matches sat on 129 networks, and without the largest of those they were still at 11.9x. Xiongmai's DVR platform, which the Mirai botnet recruited in 2016 (Krebs on Security), came next: 1,841 matches on 434 networks, and 5.4x without the largest. UniFi Video, GreyNoise's Log4Shell target, was 19 of 207, too few to lean on. ASUS routers answering with AiCloud, the feature Operation WrtHug broke into at more than 50,000 addresses in 2025 (SecurityWeek), were above their networks' rate too.

MikroTik was the volume: 46,715 of its addresses sat on exits, about 30,000 more than their networks predicted, the largest excess of any family.

Hikvision and Dahua, the two largest camera families here and targets GreyNoise saw too, were below their networks' rate. Pages whose title starts with D-Link were at their networks' rate: 61 of 1,973 (1.09x). Three hosts in all of Web IP's November 2 build had ShareCenter, GreyNoise's NAS, in their title.

What a match is

An exit address is a whole connection: a home's router, cameras and laptops share it, and over 90 days an ISP may hand it to another subscriber. So a match means the device and a proxy exit shared an address within the window, not that the device relays. Setting each family against its networks removes its AS's rate, not the household's: a home that runs proxyware on one device may be careless with others.

Using it

For a security team, Web IP filtered on title and server over the ranges it owns lists these devices, and one whose address is also in Residential Proxy IP is the edge device to look at first. For a fraud team, a WindWeb/1.0 server or a Xiongmai DVR's login page on an address is a proxy signal of its own, beyond what its network says.

How we counted

A device family is matched on the page title or Server header of each address's latest response on 443 or 80 in Web IP's November 2 build, port 443's where both answer. The families are the makers GreyNoise named, widely deployed router, firewall and NAS makers, and the titles that stood out when every title was set against its networks. A network is an address's origin AS in IP ASN, and ISP networks are those with type isp in ASN. Residential Proxy IP is its 90-day window to November 2, less the addresses whose first_seen and last_seen both fall between September 5 and October 7. An address on a network with no Web IP address outside its family is left out of the last column: 1,868 of MikroTik's, 1,126 of Ubiquiti's, and under 30 of any other family's in the table.

Getting access

Web IP ships as CSV, and its docs list the columns, as Residential Proxy IP's do. Sign up to evaluate Web IP from its sample, and see licensing for its terms. For Residential Proxy IP, talk to us.