Free VPNs and popular streaming apps bombard corporate networks with ‘laundered’ traffic used by criminals to ‘blend in with normal consumer noise’ – here’s how to keep yourself safe

Threat Infoblox Intel Finds Over 65% of Its Cloud Customers Made DNS Queries to Residential Proxy Domains in 2026
Residential proxies could pose legal risks or reputational damage if malicious actors abuse them.
While not all residential proxies are illegal, abusers take advantage of the anonymity associated with cheap, unauthorized residential proxies to perform tasks that may be unethical, or sometimes downright illegal.

Users who install free VPNs, streaming apps, and even productivity apps may be unaware that they are often unintentionally using the product themselves.

The old adage that there is no such thing as a free lunch rings true here, as many of these “free” services essentially rent an unsuspecting victim’s network identity to strangers, many of whom use it for malicious purposes.

This practice, considered fair by many such applications, has security and privacy implications, in addition to users being flagged for fraud or additional verification, as data center IP reputation systems take into account requests apparently originating from a victim’s network.

Blend in for a reason

The service used here is called a “residential proxy” and while legitimate providers may exist, many sources are dubious to say the least. Indeed, the demand for “clean” residential proxies is both enormous and constant.

Research from Infoblox Threat Intel indicates that the situation is more dire than previously thought, as nearly two-thirds (65%) of its Threat Defense Cloud customers made DNS queries on domains used to access or orchestrate residential proxy networks in 2026, totaling more than 500 billion such queries per month.

This is different from anonymizers like Tor or commercial VPNs, which produce anonymized traffic via volunteer nodes for the former and data center IP addresses for the latter. It leverages existing hardware on the home network, such as home routers, phones, IoT gadgets, or anything else that can essentially run a proxy service.

The interesting part is that most of these services never obtain permission from a “host” and never bury such clauses deep in their End User License Agreement (EULA), which often leads to unsuspecting victims “helping” in malicious activities such as fraud, unauthorized data scraping, and even streaming services that bypass regional limitations.

Victims suffer because not only do these services essentially take over their existing connections, slowing down their Internet connection, but they could also result in their IP addresses or networks being marked as unreliable or even fraudulent if incidents remain regular. This could expose them to legal problems: it is difficult, time-consuming and sometimes downright impossible to prove that you were the conduit rather than the perpetrator of said activities.

Avoiding this is easier said than done, but there are ways to reduce vulnerability to this type of abuse. A software audit should be your first line of defense. Knowing what’s running on all your devices and whether it’s trusted or not is essential to preventing exposure.

Particular attention should be paid to free VPNs, cheap IoT devices from questionable manufacturers, streaming software, and even browser extensions, all of which can expose you to bad actors. Investing in a router or software service that blocks such queries would also be very helpful, as would using protective DNS to monitor your network.

For starters, users can also use services to monitor and check the risk profile of their intellectual property, allowing them to determine if they are already being abused.

Google logo on black background next to text