RESIP Host Detection: Identification of Malicious Residential IP Proxy Flows

The number of residential proxies as a service has grown as an emerging gray-area business, in which a provider utilises (compromised) hosts inside residential networks in order to provide anonymity services, effectively hiding the IP addresses of their clients behind other, seemingly normal, Residential IP (RESIP) addresses. This paper investigates commercial RESIP proxy service providers and looks into their host recruitment practices, which are often suspicious or borderline legal. In turn, the paper proposes a detection mechanism for identifying RESIP proxy flows on compromised consumer electronic devices, whereby the proxy software may operate without the user’s knowledge or explicit consent.