The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Proxyjacking is the unauthorized use of a compromised router, server, IoT device or application as a proxy for someone else’s internet traffic. The operator earns money by selling the device’s bandwidth through a proxy-sharing service, while websites see the victim’s IP address. Because proxyjacking often uses little CPU, it can remain unnoticed longer than cryptojacking.
The danger is not limited to a slower connection. Criminals can route phishing, brute-force attacks, fake-account creation, data theft and illegal purchases through your address, potentially making your household or organization appear responsible.
As an Amazon Associate I earn from qualifying purchases.
How proxyjacking works
A proxy is an intermediary that sends web requests on behalf of another user. In a residential proxy arrangement, a website records the residential device’s IP address rather than the true origin of the request. The FBI’s Internet Crime Complaint Center (IC3) warned on March 12, 2026 that once an internet-connected device is compromised, “the device’s IP address can be used by threat actors to mask their online illegal activity, making the consumer appear responsible.”
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
In a proxyjacking attack, malware or an unwanted software component turns a device into a proxy node. The attacker then enrolls that node in a bandwidth-sharing network and receives payment for traffic routed through it. Akamai’s Security Intelligence Response Team described this as covertly monetizing unused bandwidth through services such as Peer2Profit or Honeygain, with only a fraction of the resource load required for cryptomining.
#1 Best Overall
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
The device may therefore show no dramatic processor or graphics-card spike. Its most visible activity can be outbound network traffic, intermittent slowdowns or a change in the reputation of its public IP address.
What recent campaigns did
Akamai campaign observed in 2023
On June 29, 2023, Akamai reported attackers targeting servers with exposed or vulnerable SSH access. The intrusion chain used encoded Bash scripts, downloaded Docker images, enrolled hosts in Peer2Profit or Honeygain, and removed competing proxy containers so the attackers retained the bandwidth. A compromised web server supplied dependencies and helped conceal the campaign’s infrastructure.
Rank #2
- DUAL-BAND WIFI 6 ROUTER: Wi-Fi 6(802.11ax) technology achieves faster speeds, greater capacity and reduced network congestion compared to the previous gen. All WiFi routers require a separate modem. Dual-Band WiFi routers do not support the 6 GHz band.
- AX1800: Enjoy smoother and more stable streaming, gaming, downloading with 1.8 Gbps total bandwidth (up to 1200 Mbps on 5 GHz and up to 574 Mbps on 2.4 GHz). Performance varies by conditions, distance to devices, and obstacles such as walls.
- CONNECT MORE DEVICES: Wi-Fi 6 technology communicates more data to more devices simultaneously using revolutionary OFDMA technology
- EXTENSIVE COVERAGE: Achieve the strong, reliable WiFi coverage with Archer AX1800 as it focuses signal strength to your devices far away using Beamforming technology, 4 high-gain antennas and an advanced front-end module (FEM) chipset
- OUR CYBERSECURITY COMMITMENT: TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
Akamai observed public Docker images for the two services with more than 1 million downloads and identified a proxy list containing more than 16,500 open proxies. Those figures describe the infrastructure and images seen in that investigation; they are not a measurement of the total number of proxyjacking victims.
Unit 42 activity beginning in 2025
Palo Alto Networks Unit 42 reported a separate campaign that began in early March 2025. It exploited GeoServer vulnerability CVE-2024-36401, rated CVSS 9.8, to obtain remote code execution. The attackers delivered modified executables, software-development kits and a bandwidth-sharing application, emphasizing low resource consumption and persistence.
Rank #3
- Tri-Band WiFi 6E Router - Up to 5400 Mbps WiFi for faster browsing, streaming, gaming and downloading, all at the same time(6 GHz: 2402 Mbps;5 GHz: 2402 Mbps;2.4 GHz: 574 Mbps)
- WiFi 6E Unleashed – The 6 GHz band brings more bandwidth, faster speeds, and near-zero latency; Enables more responsive gaming and video chatting
- Connect More Devices—True Tri-Band and OFDMA technology increase capacity by 4 times to enable simultaneous transmission to more devices
- Unique Design, More RAM, Better Processing - A unique housing design provides optimal heat dissipation, combined with a 1.0 GHz dual-core CPU and 512 MB High-Speed Memory, the AXE75 is designed for long-term reliability and performance.
- EasyMesh-compatible - Extend network range even more by adding EasyMesh-compatible routers, extenders, or wireless powerline adapters for a seamless, whole-home connection. Eliminate dead zones, drops, and lag as you move across your home.
These two investigations involve different infrastructure and dates. Their indicators should not be treated as universal signatures for every proxyjacking incident, but they show how both exposed servers and vulnerable applications can be recruited.
How a device gets recruited
The FBI identifies several common routes:
- Malicious or undisclosed SDKs: An application may include proxy code that runs in the background under a partnership or revenue-sharing arrangement.
- Free VPN applications with hidden terms: Fine print may authorize the provider or its partners to route other people’s traffic through your connection.
- Compromised IoT equipment: Routers, streaming boxes, digital picture frames and similar devices can be infected and operated remotely.
- Pirated or unofficial software and media: Malware bundled with unauthorized content can install a proxy component.
- Deceptive passive-income applications: A program may promise payment for “sharing” bandwidth without making the security and legal consequences clear.
The FBI’s May 7, 2025 router alert adds that end-of-life routers are especially exposed because vendors no longer provide security patches. Variants of TheMoon malware have installed proxy software after exploiting vulnerable devices, with remote administration enabled being a particularly dangerous configuration.
Rank #4
- Dual-band Wi-Fi with 5 GHz speeds up to 867 Mbps and 2.4 GHz speeds up to 300 Mbps, delivering 1200 Mbps of total bandwidth¹. Dual-band routers do not support 6 GHz. Performance varies by conditions, distance to devices, and obstacles such as walls.
- Covers up to 1,000 sq. ft. with four external antennas for stable wireless connections and optimal coverage.
- Supports IGMP Proxy/Snooping, Bridge and Tag VLAN to optimize IPTV streaming
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
- Advanced Security with WPA3 - The latest Wi-Fi security protocol, WPA3, brings new capabilities to improve cybersecurity in personal networks
What criminals do through a hijacked connection
A proxyjacked IP address can be used for:
- Command-and-control traffic that conceals the attacker’s infrastructure
- Phishing, identity theft and spam campaigns
- Creation of fake accounts and fraudulent reviews
- Brute-force password attacks and account takeovers
- Data exfiltration
- Bypassing regional restrictions
- Access to illicit marketplaces and illegal purchases
For the owner, consequences can include consumed bandwidth, degraded connectivity, abuse complaints, blocked services and damage to the reputation of the public IP range. If investigators or websites see only that address, the victim may initially appear to be the source of the activity.
Proxyjacking versus cryptojacking
| Characteristic | Proxyjacking | Cryptojacking |
|---|---|---|
| Resource monetized | Internet bandwidth and the device’s IP address | CPU or GPU computation for cryptocurrency mining |
| Typical visibility | Often modest CPU use; network activity can be the main clue | Usually sustained processor or graphics utilization and higher power draw |
| Common access path | Proxy enrollment through malware, an SDK, a dubious app or a compromised IoT device | A mining payload installed after compromise |
| Primary victim impact | Slower service, bandwidth charges, IP blocking and possible association with criminal traffic | Heat, fan noise, electricity costs and accelerated hardware wear |
| Best first signal to check | Unexpected outbound traffic, Docker containers or proxy-related processes | Persistent CPU/GPU and power anomalies |
How to check whether your connection is being used
On servers and computers
- List running Docker containers and investigate unfamiliar images, especially bandwidth-sharing containers or ones that return after removal.
- Review processes, scheduled tasks, startup services and recent shell commands for encoded scripts or unknown executables.
- Monitor outbound connections and total egress volume. A moderate CPU graph does not rule out substantial proxy traffic.
- Inspect exposed SSH, web applications and other internet-facing services for missing patches, weak credentials or unexpected administrator accounts.
- Check firewall and flow logs for repeated connections to unfamiliar destinations or traffic at times the device is normally idle.
On home routers and IoT devices
- Review the router’s administrator accounts, DNS settings, port-forwarding rules and remote-management status for changes you did not make.
- Look for unexplained temperature increases, reboots, connectivity problems or unusual data consumption.
- Check the firmware version and vendor support status. An end-of-life model cannot receive the fixes needed to close newly discovered flaws.
- Investigate an abuse notice, a sudden IP-reputation problem or websites blocking your address as a possible compromise signal, not merely a customer-service issue.
Indicators from the Akamai and Unit 42 investigations are campaign-specific. A clean result from one check does not prove that every device on a network is safe.
How to stop and recover from proxyjacking
- Isolate the suspected device. Disconnect its network cable or place it in a quarantine segment. Do not continue normal browsing from a device that may be routing someone else’s traffic.
- Preserve useful evidence. Save router, firewall, Docker and system logs before resetting equipment if an employer, internet provider or law-enforcement report may require them.
- Remove the access path. Disable internet-facing SSH or other services that are not required, turn off router remote administration, and close unnecessary firewall ports.
- Patch or replace. Update the operating system, applications, firmware, firewall and exposed services. Replace an end-of-life router with a currently supported Wi-Fi router when updates are unavailable.
- Change credentials. Set strong, unique passwords for router, administrator, cloud and application accounts, and revoke unknown accounts, keys and sessions.
- Clean the host. Remove unauthorized containers and software, run reputable antivirus or endpoint security, and reinstall the operating system when cleanup cannot be verified.
- Rebuild safely. Restore only trusted backups, install software from official stores or reputable publishers, and place IoT devices on a separate network with restrictive firewall rules.
- Report and protect accounts. Report suspected victimization to the FBI’s IC3, notify your internet provider if appropriate, and contact account providers to secure credentials or transactions that may have been exposed.
Preventive controls that reduce the risk
- Apply security updates promptly, prioritizing known exploited vulnerabilities on internet-facing systems.
- Replace unsupported routers and keep remote administration disabled unless it is essential and tightly restricted.
- Allow only authorized devices onto business and home networks; use separate guest or IoT segments.
- Install applications from official stores or reputable publishers, and avoid pirated content and dubious free VPNs.
- Use firewall egress rules, DNS filtering and network monitoring to identify unexpected proxy traffic.
- Where operationally appropriate, block known residential-proxy addresses while recognizing that lists change and blocking can affect legitimate users.
How widespread is proxyjacking?
No authoritative global victim or prevalence figure is established here. The more-than-1-million-download figure for public proxy Docker images and the 16,500-plus open proxies were measurements reported by Akamai for its 2023 investigation, while the CVSS 9.8 score applies specifically to GeoServer CVE-2024-36401 in the Unit 42 report. They demonstrate scale and severity in documented cases, not the size of the entire threat.
Bottom line
Proxyjacking converts an overlooked device into a paid relay for somebody else’s traffic. Its low CPU footprint makes network, container and router monitoring essential. Prompt patching, supported hardware, disabled remote administration, segmented networks and a clear isolation-and-recovery plan can prevent a hijacked IP address from becoming a criminal’s cover.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors
