Residential proxy networks monetize end-user bandwidth, reselling access to millions of consumer IPs for scraping and, increasingly, abuse. From a network-operator vantage point these flows are hard to characterize: the traffic blends with normal residential activity, and the underlying client software is rarely documented. This talk combines two perspectives on the problem. Through reverse engineering of the client software, we gained an understanding of the software and the residential proxies’ modus operandi. As a follow up we used the resulting network IOCs in NetFlow analysis at a large Dutch academic research network to quantify their occurrence.
