Disrupting the largest residential proxy network
126 points
2 days ago
| 12 comments
| cloud.google.com
| HN
progbits
6 hours ago
[-]
I'm surprised by the negative takes...

Yes, proxies are good. Ones which you pay for and which are running legitimately, with the knowledge (and compensation) of those who run them.

Malware in random apps running on your device without your knowledge is bad.

reply
throwoutway
1 hour ago
[-]
> Malware in random apps running on your device without your knowledge is bad.

And ones that have all the indicators of compromise of Russia, Iran, DPRK, PRC, etc

reply
bdcravens
5 hours ago
[-]
Many are "compensated" (in the way of software they didn't pay for), so the real question is that of disclosure (in which case many software vendors check the box in the most minimal way possible by including it as fine print during the install)
reply
happyopossum
4 hours ago
[-]
No, the question is not just disclosure. People have their bandwidth stolen, and sometimes internet access revoked due to this kind of fraud and misuse - disclosure wouldn’t solve that
reply
the_fall
3 hours ago
[-]
Also, as a website owner, these residential proxies are a real pain. Tons and tons of abusive traffic, including people trying to exploit vulnerabilities and patently broken crawlers that send insane numbers of requests, and no real way to block it.

It's just nasty stuff. Intent matters, and if you're selling a service that's used only by the bad guys, you're a bad guy too. This is not some dual-use, maybe-we-should-accept-the-risks deal that you have with Tor.

reply
bigfatkitten
13 minutes ago
[-]
If they're lucky. Sometimes people have their doors kicked in by armed police.
reply
CodeMage
3 hours ago
[-]
Getting rid of malware is good. A private for-profit company exercising its power over the Internet, not so much. We should have appropriate organizations for this.
reply
vachina
57 minutes ago
[-]
The proxies is the reason why you get spam in your Google search result, spam in your Play store (by means of fake good reviews), basically spam in anything user generated.

It directly affects Google and you, I don’t see why they should not do this.

reply
Nextgrid
30 minutes ago
[-]
Spam in Google search results is due to Google happily taking money from the spammers in exchange for promoting their spam, or that the spam sites benefit Google indirectly by embedding Google Ads/Analytics.

I don't see any spam in Kagi, so clearly there is a way to detect and filter it out. Google is simply not doing so because it would cut into their profits.

reply
UqWBcuFx6NV4r
1 hour ago
[-]
Okay. You get right on that. In the meantime, would you rather they did nothing? What do you actually want, in concrete terms?
reply
xyzzy_plugh
8 hours ago
[-]
> These efforts to help keep the broader digital ecosystem safe supplement the protections we have to safeguard Android users on certified devices. We ensured Google Play Protect, Android’s built-in security protection, automatically warns users and removes applications known to incorporate IPIDEA SDKs, and blocks any future install attempts.

Nice to see Google Play Protect actually serving a purpose for once.

reply
trollbridge
6 hours ago
[-]
Yeah, it serves the purpose of blocking this kind of proxy traffic that isn't in Google's personal best interests.

Only Google is allowed to scrape the web.

reply
1vuio0pswjnm7
9 minutes ago
[-]
"Only Google is allowed to scrape the web."

If I m not mistaken, the plaintiffs in the US v Google antitrust case in the DC Circuit tried to argue that website operators are biased toward allowing Google to crawl and against allowing other search engines to do the same

The Court rejected this argument because the plaintiffs did not present any evidence to support it

For someone who does not follow the web's history, how would one produce direct evidence that the bias exists

reply
vachina
49 minutes ago
[-]
This is demonstrably false by the success of many scrapers from AI companies.
reply
Nextgrid
26 minutes ago
[-]
LLMs aren't a good indicator of success here because an LLM trained on 80% of the data is just as good as one trained on 100%, assuming the type/category of data is distributed evenly. Proxies help when you do need to get access to 100% of the data.
reply
a456463
6 hours ago
[-]
Yup exactly. Google must be the only one allowed to scrape the web. Google can't have any other competition. Calling it in "user's best interest" is just like their other marketing cons: "play integrity for user's security" etc
reply
viraptor
4 hours ago
[-]
Have you got any proof of Google scraping from residential proxies users don't know about, rather than from their clearly labelled AS? Otherwise you're mixing entirely different things into one claim.
reply
misir
3 hours ago
[-]
That's the whole point. Websites that try to block scraping attempts will let google scrape without any hurdle because of google's ads and search network. This gives google some advantage over new players because as a new name brand you are hardly going to convince a website to allow scraping even if your product may actually be more advantageous to the website (for example assume you made a search engine that doesn't suck like google, and aggregates links instead of copying content from your website).

Proxies in comparison can allow new players to have some playing chance. That said I doubt any legitimate & ethical business would use proxies.

reply
idiotsecant
3 hours ago
[-]
I don't think parent post is claiming that Google is using other people's networks to scrape the web only that they have a strong incentive to keep other players from doing that.
reply
viraptor
3 hours ago
[-]
No, there are other scrapers that Google doesn't block or interact with. You can even run scraping from GCP. This has nothing to do with "only Google is allowed to scrape". They even host apps which exist for scraping data, like https://play.google.com/store/apps/details?id=com.sociallead...
reply
direwolf20
4 hours ago
[-]
Does it also block unwanted traffic from Google apps or does it have a particular hatred for companies that interfere with Google's business model?
reply
tgsovlerkhgsel
4 hours ago
[-]
Play Protect blocks malicious apps, not network traffic, so no, it obviously doesn't interfere with Google's apps.

AFAIK it also left SmartTube (an alternative YouTube client) alone until the developer got pwned and the app trojanized with this kind of SDK, and the clean versions are AFAIK again being left alone. No guarantee that it won't change in the future, of course, but so far they seem to not be abusing it.

reply
direwolf20
3 hours ago
[-]
Does malicious mean interfering with Google's business model, or does it include intrusive advertising?
reply
whartung
7 hours ago
[-]
My understanding is that routing through residential IPs is a part of the business of some VPN providers. I don't know how above board they are on this (as in notifying customers that this may happen, however buried in the usage agreement, or even allowing them to opt out).

But, my main point, is that the whole business is "on the up and up" vs some dark botnet.

reply
kawsper
3 hours ago
[-]
Oxylabs sells proxies for scrapers, I suppose you can use the socks-proxy as a VPN, and they claim to use Honeygain.

Honeygain is a platform where people sell their residential internet connection and bandwidth to these companies for money.

For comparison Honeygain pays someone 10 cents per GB, and Oxylabs sells it for $8/GB.

reply
aussieguy1234
40 minutes ago
[-]
That takes buying low and selling high to a whole new level
reply
nielsbot
7 hours ago
[-]
FTA

> While operators of residential proxies often extol the privacy and freedom of expression benefits of residential proxies, Google Threat Intelligence Group’s (GTIG) research shows that these proxies are overwhelmingly misused by bad actors

reply
direwolf20
7 hours ago
[-]
Google's definition of a "bad actor" is someone who wants to use Google without seeing the ads. Or Kagi. Or an AI other than Gemini.
reply
scirob
6 hours ago
[-]
so that only google and anthropic are allowed to scrape the web. No one else may have workarounds
reply
a456463
6 hours ago
[-]
Exactly. This is just google building a "moat" around their shady business.
reply
cvalka
1 hour ago
[-]
100%
reply
chatmasta
2 hours ago
[-]
Why are they leaving Bright Data (aka Illuminati aka Hola VPN) untouched? They are doing this exact scheme on an industrial scale.
reply
7thpower
1 hour ago
[-]
They have a robust KYC that appears to serve, at least in large part, as a way to stay off the shit list of companies with the resources to pursue recourse.

Source: went through that process, ended up going a different route. The rep was refreshingly transparent about where they get the data, why the have the kyc process (aside from regulatory compliance).

Ended up going with a different provider who has been cheaper and very reliable, so no complaints.

reply
chatmasta
38 minutes ago
[-]
Yeah, they make you do a Skype interview (or probably Zoom interview nowadays). You could call this KYC or collateral, depending on your view of the company. It does limit the nefariousness of their clientele but I doubt they do much, or any, monitoring of actual traffic after onboarding (not for compliance reasons, anyway).
reply
londons_explore
7 hours ago
[-]
We need more residential proxies, not less.

I've had enough of companies saying "you're connecting from an AWS IP address, therefore you aren't allowed in, or must buy enterprise licensing". Reddit is an example which totally blocks all data to non-residential IP's.

I want exactly the same content visible no matter who you are or where you are connecting from, and a robust network of residential proxies is a stepping stone to achieving that.

reply
ndiddy
7 hours ago
[-]
If you look at the article, the network they disrupted pays software vendors per-download to sneakily turn their users into residential proxy endpoints. I'm sure that at least some of the time the user is technically agreeing to some wording buried in the ToS saying they consent to this, but it's certainly unethical. I wouldn't want to proxy traffic from random people through my home network, that's how you get legal threats from media companies or the police called to your house.
reply
londons_explore
7 hours ago
[-]
> that's how you get legal threats from media companies or the police called to your house.

Or residential proxies get so widespread that almost every house has a proxy in, and it becomes the new way the internet works - "for privacy, your data has been routed through someone else's connection at random".

reply
Imustaskforhelp
6 hours ago
[-]
> Or residential proxies get so widespread that almost every house has a proxy in, and it becomes the new way the internet works - "for privacy, your data has been routed through someone else's connection at random".

Is this a re-invention of tor, maybe I2P?

reply
rolph
5 hours ago
[-]
IP8 address tumbler? to wit, playing the shell game, to obstruct direct attribution.
reply
dataviz1000
6 hours ago
[-]
They provide an SDK for mobile developers. Here is a video of how it works. [0] They don't even hide it.

[0] https://www.youtube.com/watch?v=1a9HLrwvUO4&t=15s

reply
ndiddy
5 hours ago
[-]
Of course they're pitching it like everything's above board, but from the article:

> While many residential proxy providers state that they source their IP addresses ethically, our analysis shows these claims are often incorrect or overstated. Many of the malicious applications we analyzed in our investigation did not disclose that they enrolled devices into the IPIDEA proxy network. Researchers have previously found uncertified and off-brand Android Open Source Project devices, such as television set top boxes, with hidden residential proxy payloads.

reply
direwolf20
4 hours ago
[-]
If popup ads that open the play store are ethical, this is ethical.
reply
JDye
6 hours ago
[-]
I live in the UK and can't view a large portion of the internet without having to submit my ID to _every_ site serving anything deemed "not safe the for the children". I had a question about a new piercing and couldn't get info on it from Reddit because of that. I try using a VPN and they're blocked too. Luckily, I work at a copmany selling proxies so I've got free proxies whenever I want, but I shouldn't _need_ to use them.

I find it funny that companies like Reddit, who make their money entirely from content produced by users for free (which is also often sourced from other parts of the internet without permission), are so against their site being scraped that they have to objectively ruin the site for everyone using it. See the API changes and killing off of third party apps.

Obviously, it's mostly for advertising purposes, but they love to talk about the load scraping puts on their site, even suing AI companies and SerpApi for it. If it's truly that bad, just offer a free API for the scrapers to use - or even an API that works out just slightly cheaper than using proxies...

My ideal internet would look something like that, all content free and accessible to everyone.

reply
Aurornis
6 hours ago
[-]
> that they have to objectively ruin the site for everyone using it. See the API changes and killing off of third party apps.

Third party app users were a very small but vocal minority. The API changes didn't drop their traffic at all. In fact, it's only gone up since then.

The datacenter IP address blocks aren't just for scrapers, it's an anti-bot measure across the board. I don't spend much time on Reddit but even the few subreddits I visited were starting to become infiltrated by obvious bot accounts doing weird karma farming operations.

Even HN routinely gets AI posting bots. It's a common technique to generate upvote rings - Make the accounts post comments so they look real enough, have the bots randomly upvote things to hide activity, and then when someone buys upvotes you have a selection of the puppet accounts upvote the targeted story. Having a lot of IP addresses and generating fake activity is key to making this work, so there's a lot of incentive to do it.

reply
JDye
5 hours ago
[-]
I agree that write-actions should be protected, especially now when every other person online is a bot. As for read-actions, I'll continue to profit off those being protected too but I wouldn't be too bothered if something suddenly changed and all content across the internet was a lot easier to access programmatically. I think only harm can come from that data being restricted to the huge (nefarious) companies that can pay for that data or negotiate backroom deals.
reply
direwolf20
4 hours ago
[-]
Reddit's traffic is almost exclusively propaganda bots.
reply
what
44 minutes ago
[-]
Have you considered that it’s because a new industry popped up that decided it was okay to slurp up the entire internet, repackage it, and resell it? Surely that couldn’t be why sites are trying to keep non humans out.
reply
201984
4 hours ago
[-]
Fix your government.
reply
JDye
3 hours ago
[-]
Thanks lad. Will get right on it.
reply
Aurornis
6 hours ago
[-]
> I want exactly the same content visible no matter who you are or where you are connecting from

The reason those IP addresses get blocked is not because of "who" is connecting, but "what"

Traffic from datacenter address ranges to sites like Reddit is almost entirely bots and scrapers. They can put a tremendous load on your site because many will try to run their queries as fast as they can with as many IPs as they can get.

Blocking these IP addresses catches a few false positives, but it's an easy step to make botting and scraping a little more expensive. Residential proxies aren't all that expensive, but now there's a little line item bill that comes with their request volume that makes them think twice.

> We need more residential proxies, not less

Great, you can always volunteer your home IP address as a start. There are services that will pay you a nominal amount for it, even.

reply
direwolf20
7 hours ago
[-]
You can run one, something like ByteLixir, Traffmonetizer, Honeygain, Pawns, there are lots more, just google "share my internet for money"

What will you be proxying? Nobody knows! I haven't had the police at my house yet.

Seems a great way to say "fuck you" to companies that block IP addresses.

You may see a few more CAPTCHAs. If you have a dynamic IP address, not many.

reply
dist-epoch
6 hours ago
[-]
How much can you make if you run all of them at the same time?

Doesn't the ISP detect them?

reply
direwolf20
4 hours ago
[-]
like $3 a month

and why would they

reply
tokyobreakfast
6 hours ago
[-]
> I've had enough of companies saying "you're connecting from an AWS IP address

I run a honeypot and the amount of bot traffic coming from AWS is insane. It's like 80% before filtering, and it's 100% illegitimate.

reply
yuliyp
3 hours ago
[-]
The end game of that is no useful content being accessible without login, or needing some sort of other proof-of-legitimacy.
reply
Nextgrid
18 minutes ago
[-]
That's already the case (irrespective of residential proxies) because content only serves as bait for someone to hand over personal information (during signup/login) and then engage with ads.

Proxies actually help with that by facilitating mass account registration and scraping of the content without wasting a human's time "engaging" with ads.

reply
supertrope
2 hours ago
[-]
Amazon.com now only shows you a few reviews. To see the rest you must login. Social media websites have long gated the carrots behind a login. Anandtech just took their ball and went home by going offline.
reply
nine_k
4 hours ago
[-]
There's a company that pays you to keep their box connected to your residential router. I assume it sells residential proxy services, maybe also DDoS services, I don't know. It's aptly named Absurd Computing.
reply
crtasm
5 hours ago
[-]
I'm reading reddit.com from a Tor node, they also have a .onion domain you could use.
reply
Jblx2
5 hours ago
[-]
Anyone know how to create a usable reddit account from the .onion domain?
reply
phyzome
4 hours ago
[-]
I've tried it, and my account was shadowbanned a few hours after I created it. It's very obnoxious.
reply
cluckindan
4 hours ago
[-]
Reddit bots shadowban almost everyone who post before they have enough comment karma. Nothing to do with Tor or VPN.
reply
xg15
7 hours ago
[-]
Also, nevermind the tech companies building their own proxy networks, such as Find My or Amazon Sidewalk.
reply
a456463
6 hours ago
[-]
Agreed. With things people paid for and using our wifi data to build their "positioning dbs" that you can't block or turn off on your phone, without "rooting" your own device.
reply
enneff
6 hours ago
[-]
How is Find My a proxy network?
reply
direwolf20
4 hours ago
[-]
In the literal sense. Your traffic is proxied through devices belonging to unwilling strangers.
reply
enneff
4 hours ago
[-]
By “your traffic” you mean device location reports? Or something else?
reply
DANmode
1 hour ago
[-]
The data that powers the app tracking your devices, shown on your devices, yes.

(What else?)

reply
enneff
1 hour ago
[-]
I don’t know. I wouldn’t have thought of myself as proxying other people’s traffic by carrying my iPhone around. (For one thing, it’s my own phone that initiates all the activity- it monitors for Apple devices, the devices don’t reach out to my phone.) I can see how you could frame it that way, though. I just thought they might be referring to something else that I didn’t know about.
reply
MBCook
42 minutes ago
[-]
I remain skeptical. I can understand how one would might see it that way, but I think it’s stretching the word proxy too far.

Devices on Apple’s Find My aren’t broadcasting anything like packets that get forwarded to a destination of their choosing. I would think that would be a necessity to call it “proxying”.

They’re just broadcasting basic information about themselves into the void. The phones report back what they’ve picked up.

That doesn’t fit the definition to me.

I absolutely don’t mind the fact that my phone is doing that. The amount of data is ridiculously minuscule. And it’s sort of a tit for tat thing. Yeah my phone does it, but so does theirs. So just like I may be helping you locate your AirTag, you would be helping me locate mine. Or any other device I own that shows up on Find My.

It’s a very close to a classic public good, with the only restriction being that you own a relevant device.

reply
packetslave
7 hours ago
[-]
> Reddit is an example which totally blocks all data to non-residential IP's.

No, we don't.

reply
direwolf20
7 hours ago
[-]
Have you tried it? Every new account will be shadowbanned and if it's shared you often get blank page 429. None of this was true before the API shutdown.
reply
3rodents
6 hours ago
[-]
That’s not my experience, using various VPNs, public networks, Cloudflare and Apple private relays. A captcha is common when logged out but that’s about it, I have not encountered any shadow bans. I create a new account each week.
reply
gruez
7 hours ago
[-]
>Every new account will be shadowbanned

That's not the same as "blocks all data to non-residential IP's"?

>if it's shared you often get blank page 429. None of this was true before the API shutdown.

See my other comment. I agree there's a non-zero amount of VPNs that are banned from reddit, but it's also not particularly hard to find a VPN that's not banned on reddit.

reply
interloxia
6 hours ago
[-]
Probably not hard but my poor little innocent VPS at Hetzer that I have had for years is denied and that makes me sad.
reply
piskov
7 hours ago
[-]
Yes you do.

Private VPS for personal VPN in Netherlands (digital ocean), then Hungary (some small local DC) — both are blocked from day one.

> You've been blocked by network security. To continue, log in to your Reddit account or use your developer token. If you think you've been blocked by mistake, file a ticket below and we'll look into it.

reply
what
35 minutes ago
[-]
Sounds like you just need to sign in or use the api?
reply
Imustaskforhelp
6 hours ago
[-]
Proton VPN sometimes (mostly?) has this issue too. It's a bit of an hit or miss in there iirc but I have definitely seen the last message of your comment.
reply
hackeman300
7 hours ago
[-]
Try browsing from any Mullvad vpn. You will be "blocked by network security"
reply
edoceo
6 hours ago
[-]
I use mullvad regularly & visit reddit from that connection - it works. But! You have to sign-in.
reply
gruez
7 hours ago
[-]
That's just mullvad's IP pool being banned. The other VPN providers I use aren't banned, or at least are only intermittently banned that I can easily switch to another server.
reply
yuliyp
3 hours ago
[-]
... if you're logged out. Log in so they don't have to lump you in with every scraper you're sharing a subnet with.
reply
thot_experiment
6 hours ago
[-]
I have never interacted with a reddit employee who wasn't actively gaslighting me about the platform. Do you even use the site? I talked to a PM recently who genuinely thought the phone app was something people liked.
reply
MBCook
38 minutes ago
[-]
There are people who actively like it.

I don’t. But they 100% exist.

reply
direwolf20
4 hours ago
[-]
They probably get paid by how many people believe their nonsense.
reply
leftouterjoins
4 hours ago
[-]
everything on Reddit is so locked down it’s useless. even if you do get to post something useful some basement dwelling mod will block it for an arcane interpretation of one of the subreddits 14 rules.
reply
dvngnt_
6 hours ago
[-]
there are several times where I've had to disable PIA to access reddit's login page
reply
a456463
6 hours ago
[-]
Have you tried using it logged out on a vpn? It is impossible.
reply
a456463
6 hours ago
[-]
This blog post from the company that used promise "don't be evil", one that steals water for data centers from vilages and towns via shady deals, whose whole premise it stealing other people's stuff and claiming it as their own and locking them out and selling their data.. Who made them the arbiter of the internet? No one!!!

They just stole this and get on their high horse to tell people how to use internet? You can eff right off Google.

reply
BoredPositron
6 hours ago
[-]
I still "run" a small ISP with a few thousand residential ips from my scraping days. The requirements are laughable and costs were negligible in the early 2000s.
reply
IhateAI
3 hours ago
[-]
How do you stop mobile proxies operating through similar nefarious business models... CGNAT prevents you from easily identifying the exit nodes.
reply
UqWBcuFx6NV4r
1 hour ago
[-]
Working with network operators.
reply
Nextgrid
11 minutes ago
[-]
Network operators have zero reason to care, they get paid per the GB for the bandwidth.
reply
ExpertAdvisor01
1 hour ago
[-]
Of course brightdata doesn't get touched.
reply
direwolf20
7 hours ago
[-]
All of this sounds legal, so on what basis did they get them shut down?
reply
SOTGO
7 hours ago
[-]
I haven't looked at any court documents, but the WSJ article from Wednesday reported that "Last year, Google sued the anonymous operators of a network of more than 10 million internet-connected televisions, tablets and projectors, saying they had secretly pre-installed residential proxy software on them... an Ipidea spokeswoman acknowledged in an email that the company and its partners had engaged in “relatively aggressive market expansion strategies” and “conducted promotional activities in inappropriate venues (e.g., hacker forums)...”"

There was also a botnet, Kimwolf, that apparently leveraged an exploit to use the residential proxy service, so it may be related to Ipidea not shutting them down.

reply
direwolf20
3 hours ago
[-]
Google does much worse in Google–branded devices and apps, like the wifi location data harvesting.
reply
kotaKat
8 hours ago
[-]
I'm actually a little shocked seeing that there was a WebOS variant of the residential proxying SDK endpoint. Does that mean there might be a bit more unchecked malware lurking behind the scenes in the LG ecosystem?

Personally I'm surprised they didn't have a Samsung option.

reply
wincy
7 hours ago
[-]
I keep my brand new LG C5 totally disconnected from the internet and use my Apple TV for movie watching. I’m not going to trust a company like LG to secure their devices.
reply
xnx
7 hours ago
[-]
> trust a company like LG to secure their devices.

They have an interest in securing their devices so they can sell proxy service themselves.

reply
htx80nerd
6 hours ago
[-]
nice to see in the comments how many people didnt even do a 30 second scan of the article before clicking `add comment`
reply
samsullivan
7 hours ago
[-]
The need for proxies in any legitimate context became obsolete with starlink being so widespread. Throw up a few terminals and you have about 500-2k cgnat IP addresses to do whatever you like.
reply
JDye
6 hours ago
[-]
2k IPs is not enough to do most enterprise scale scraping. Starlink's entire ASN doesn't seem to have enough V4 addresses to handle it even.
reply
chatmasta
2 hours ago
[-]
The actual secret is to use IPv6 with varied source IPs in the same subnet, you get an insane number of IPs and 90% of anti-scraping software is not specialized enough to realize that any IP in a /64 is the same as a single IP in a /32 in IPv4.
reply