Hacker News

> benign

On a server that used to get below 1k HTTP requests a day, I've had several cases of mass scraping from these botnets exceeding 100req/s. The web is getting harder and harder to use due to all the anti-bot mechanisms site operators had to put up.

How is DDOSing every site on the web benign?

I'll just note that "compromised" is perhaps too strong. These services often come from VPN plugins (eg Hola VPN) that lets users watch sports from different restricted geographic regions. There is a trade here that's in the TOs: you get someone else's IP address, they get yours.

Why wouldn't an adversary be using it to conceal command and control traffic?

> This also puts some of the troubling reports that politicians were bringing phones into SCIFs into context…

I mean politicians are so addicted to twitter the nsa makes special phones…

A lot of people work at the White House. Many of them doubtless work a night shift. The set of candidates here is actually quite large.

Even at midnight I can't imagine there being less than 100 people working at the WH in various capacities. While it's probably not the duty/desk officers in the Situation Room/Security Council, there are plenty of maintenance staff that work at night. 5-midnight seems like it overlaps perfectly with a shift schedule.

The White House doesn't shut down at 5pm. There's whole books, TV series, and movies about the people that are working late every night at the White House. Likely dozens of people are on staff and work shifts that last until midnight every night of the week.

Service staff, including the storied hundred or so White House butlers, work whatever hours are needed. Then you have Secret Service, Kitchen staff, Natalie, house admin staff like the Chief Usher, maybe even NPS staff as the WH grounds are a national park as well, any of whom I would assume might be given access to the secure but unclassified WH wifi and likely a government-issued device. One device with a proxy among all of those people? Entirely unsurprising.

Maybe it's just the printer that Natalie carries around in her purse.

Actually sound like the opposite of someone who lives there...Sounds like a shift worker.

That timing could also align with a device that is turned on and off at specific times, for example an insecure smart TV that is generally turned on to watch TV in the evening, and turned off around midnight.

Though the fact that it lines up with an 8 hour shift also makes it seem human-like, so I think I'd rank a human carrying an infected device as more likely than an infected periodically-active device.

Or the cleaning or security staff working the night shift.

Does it continue when the prez is in Florida? Seems a good test on the hypo

If you regard 1,000 or less people as few, then this is true. If you regard 1,000 people as "too many" then you rate the national security of the USA at the cost of 1 in 1000 means it's not worth bothing to find out.

Is that really how national security works?

There’s a ton of people it could be. Any staffer that works 5-12, which wouldn’t be a particularly weird shift for cooks, cleaners, etc that bring their infected phone with them.

If it was someone who lived there it wouldn’t be exclusively that time period. Why wouldn’t it happen overnight or in the morning or any other time of day?

Unless it is running on a government issued iPhone, it is not the Individual #1 you are alluding to.

He very famously does not know how to use computers and can only basically manage tweeting from his phone, which he is mostly not, actually, doing himself.

Now, there are two or three terminally online people around him. I would be more quick to point the finger at his foul-mouthed spokesman but it’s admittedly because I hate that guy and he seems rather stupid. But perhaps it could be the devoted portable printer lady, or the overpromoted unblinking former golf caddy guy.

All of them are around to help with the, er, modern day presidential communications.

There’s at least 500 people on just the staff of the White House, not including many others who work nearby.

Do you imply this residential proxy is also a Presidential proxy?

It’s probably Natalie.

Yeah dude you’re right Trump bought an android tv from banggood and got pwned. You’re a genius.

> There is no evidence that physically ties this to the WH.

They don't need to be physically inside a specific building to be a networking security problem.

The core issue is whether an outsider has bypassed your firewall and can send+receive traffic from a node which is getting more trust than it deserves. If they've compromised the computer's microphone/camera/wifi-control that's an additional problem.

"We don't know where the devices that appear to have breached the WH network are located. For all we know, they could be in Beijing or Moscow."

That seems significantly worse.

Is it some like like NordVPN? It has an option to act as a residential proxy (useful to evade VPN IP blocks)

Perhaps ping time measurements could help identify where the devices are physically located.

For those who don't know what this is, here's a decent podcast about it:

https://darknetdiaries.com/episode/172/

There's a transcript if you want to read, not listen. At the start, you'll be "hey! I gotta get me one!" and later you'll be like "burn it with fire!"

I have seen these at mall kiosks advertising "free cable", and today I learned they are proxying from your home network.

That was the first thing I thought of!

A friend in Texas claims they recently bought one at Wal-Mart. I don't know anything about how these work but that can't be true ... right?

Those proxies are paid for in rubles, not dollars.

They are (p)residential proxies really

Executive residential proxies

There’s only that many ipv4 addresses and I believe all 5G are shared ones. That’s why they’re among the most valuable ip ranges for scraping. You can’t just naively ban that IP or you’ll ban a large group of users

You might just be experiencing T-Mobile's CGNAT on mobile broadband?

You're almost certainly behind a cgnat shared with a bunch of compromised/residential proxy running phones and other traffic.

T-Mobile esp. their 5G network is behind CGNAT

Thanks for clarifying the language. I don’t understand why we softened ‘botnet’, it’s much clearer and powerful.

Scroll down to "anonymization": https://ipinfo.io/what-is-my-ip

If there's anything there, monitor your network to figure out exactly what

Fantastic question. There is so much IOT garbage out there that someone might slip into my network, what can I do to easily detect it?

I was aghast when my partner connected a pet watering bowl to the WiFi.

This one actually works: https://news.ycombinator.com/item?id=49713037

Watch egress at the router for anything unaccounted for, tbh.

"Legal". The law is truly an ass.

Thankfully security researchers exist to fill the gaps that lawmakers haven't gotten to / won't get to: https://blog.includesecurity.com/2026/06/the-smart-tv-in-you...

These are the specific URLs mentioned:

  proxyjs.brdtnet.com
  proxyjs.luminatinet.com
  proxyjs.bright-sdk.com
  clientsdk.bright-sdk.com
  clientsdk.brdtnet.com

  /(\.|^)brdtnet\.com$/
  /(\.|^)luminatinet\.com$/
  /(\.|^)bright-sdk\.com$/
  /(\.|^)luminati\.io$/

See below for his this "consent" actually works. (The screenshot of the game.)

https://spur.us/blog/smart-tv-apps-residential-proxy-sdks

Brightdata still sucks at disclosing to users that they're opted in to this and that their connection is being used for this. It's "on by default", not opt-in and often buried in an unskippable "Accept the terms" or dig-to-opt-out prompt.

Any router capable of being flashed with OpenWRT or their own router is a good start.

It's described at a high level in media often. Here's more detail though:

Person buys a product, or downloads some software - that unknowing to them, was reaching out to a central server elsewhere to establish a network tunnel. And over that tunnel, the other server routes traffic onto that person's home network. Which can then of course go onto the internet, and it appears like the traffic originated from their home internet connection.

Other people rent access to this network. The goal being, you have surreptitious access to appear as any one of tens of thousands of home network IP addresses on the public internet. Bad guys can use this to rotate through many different IP addresses when their access gets blocked because of malicious (or benign but unwanted) behavior on the internet. Residential IP addresses are more 'valuable' because they don't have the negative connotation that datacentre and commercial IPs can have, and they can be spread geographically or across many ISPs.

A very common way for people being a part of these residential proxy networks is by buying dodgy streaming boxes, and also installing shady apps on TV app marketplaces.

It means some networked devices in there are being remotely piloted to tunnel network traffic to somewhere else. This scenario usually happens with more "unprofessional" ISPs, which sell bandwidth from their networked clients for people in need of such services.

Such as ignoring web scraping countermeasures, and DDoS.

Some good answers in this thread. I had the same question but I'm still a tad confused:

* I initially thought this meant someone in the WH network was using commercial proxies to appear as if they were exiting from a different network (which would align with "some user is firing up a proxy on their phone to exit in a different location")

* But then the description of residential proxies seemed to align more with traffic hitting an endpoint in the White House, and _exiting_ from the network there. But this didn't explain the timing (why isn't it 24/7).

* Finally it sounds like some person, legitimately on the WH network, has a device (cell phone, TV, whatever) that, when activated, is proxying outside traffic into the WH network.

There are companies that provide proxy services for scraping services, and residential proxies route through consumer networks (like Comcast) which is flagged less than a datacenter IP.

Many questionable TV streaming boxes pretend to deliver you video, but in reality they are also piggy backing on your personal ISP to power those companies.

The 4th sentence in the article has a link to What is a Residential Proxy?[0]

[0]: https://layer3intel.com/what-is-a-residential-proxy

From the article:

> Residential proxy services sell access to everyday devices, letting customers send traffic through them so it appears to come from that device's network.

They really should have said "botnet malware detected", it turns the White House into an exit IP for someone's else's botnet.

Brightdata offers it as a paid service https://brightdata.com/proxy-types/residential-proxies

Essentially lets bad actors use your home network.

There are services you can pay for such that you can route internet traffic thru a specific IP in a specific part of the world. People (usually unwillingly and unknowingly) run software that effectively makes them part of a giant botnet. A computer running in Romania might have some kind of weather application or gambling/casino app that I could use to make an HTTP request as if I were on their network. So if you need access to 1,000 or 10,000 IP's to circumvent rate limits or perform crawling tasks, this is how you could do it.

Second paragraph

Answer my own question - It was actually an outside entity that detected the problem. However , it gives the network admins a way to determine if this activity is happening on networks they are responsible for .....

Good luck turning this presidents kit off

vibe coded "black box" ie: probably shit.

Step one, find your public IP, I like ipinfo.io but there are many other services that will show it. Then pop it into a tool like the one that's hosting TFA[1]

1: https://layer3intel.com/context

Unexpected traffic would be the biggest gross red flag. If it constrains itself to moving traffic when it's otherwise perform its desired function (if it's one of those "free TV" boxes and it only proxies when you're playing video) it might be hard to tease-out the unwanted traffic purely looking at bytes in/out.

Beyond that gross metric you're getting into capturing traffic and decoding it.

Check network traffic from smart devices would be a good start. If your TV does gigabytes of traffic in the night when you don’t use it, it most likely is acting as a residential proxy.

Residential IP addresses tend to have better reputations than datacenter networks, so there are providers who sell access to home internet connections. Oftentimes the people running the proxies have no idea they're running on their network, they're quasi malicious.

https://cloud.google.com/blog/topics/threat-intelligence/goo...

It's pretty much exactly a Tailscale exit node, just one that somebody else installed without your knowledge or consent.

Generally not really. Residential proxies are services that can provide customers with the ability to send and receive traffic from a wide range of apparently legitimate networks (i.e. people's home internet connections). Almost always this is done without the informed consent of the person who owns the device that is used as a proxy, whether it be buried in some agreement somewhere or just outright malware.

The biggest danger is that said proxies can also allow access to internal networks, and as you might guess from how they are installed, are not usually operated by the most scrupulous of organizations.

it’s a well known term in shady markets of the internet, they allow users and abusers to bypass bans and create multiple accounts that cannot be linked with each other by networking intel

It is tricky. Monitoring network traffic should be enough, the infected device has to connect to Command and Control, to receive orders and set up tunnels. It got harder after malware creators started using Telegram, Discord or even good old IRC for those purposes - it will be asy to notice only if they use a service no one else uses in your network.

Step 1: have you installed anything from an app store such as Google Play or Apple's app store?

Step 2: have you bought any devices made by large companies like LG or Samsung?

I'd still find a way to block your scrapers.

Why do you use stablecoins and not credit cards like every other non-shady business on the internet?

Uhh, and what exactly is the benefit for end users to have their devices send out ddos and scraping traffic?

It should be made illegal.

Do you really think your users aren’t installing onto every device they can break into to make a buck? Ignorance is bliss I guess.

Love me some buttery males

... and then Donald Trump as President, Stephen Miller as, whatever he is, and Peter Hegseth as Defense Secretary (he did serve in the military, if that's worth anything).

I think it's pretty wild to make all these bold assertions about the absolute top tier of elite talent that the US federal gov recruits and retains, and then compare/contrast that with the current staffers of the present incarnation of the executive branch. It just doesn't jive. Seriously, do a deep dive into Hegseth's resume and background of the nonprofit he was the figurehead for. He's more qualified than some known 3/4-star generals? Seriously? Tulsi Gabbard was the most qualified person for DNI? Seriously?

I would actually feel better if this were the case, but given that we have "the very best people" currently running our cybersecurity infrastructure I doubt it.

Most likely scenario is a 20-something holdover from DOGE who accidentally had his phone p0wned while downloading groyper memes.

Monitoring is the easy part, remedying the problems has proved harder. From early in the first Trump administration:

https://lieu.house.gov/media-center/in-the-news/what-can-we-...

The joke that S in "IoT" stands for Security is as old as the term itself, but there were no such clear incentives for exploiting them before, beyond basic DDoS and more recently crypto mining.

> Residential proxies are a very important part of the internet, they allow scraping for archiving, automation and can be used for extra anonymity.

Aren't they almost always run unknowingly, by people tricked into running them?

Leveraging compromised devices is a very important part of the Internet??? This is an incredibly twisted perspective.

Help me understand. As far as I'm aware, these residential proxies are almost always malware.

"Malware is an important part of the Internet"

> and can be used for extra anonymity

Great, so you can conduct illegal transactions and have some unsuspecting grandma take the blame and have her front door kicked in?

And making DDoS-attacks nigh impossible to IP block.

Residential proxies are in many cases at least shady, both on the side of who uses them and for what and on providers that are often not above using dark pattern to hide them in some innocuous app for a smart-whatever that silently runs a proxy on a unaware user's connection. And in many places in the world if illegal stuff in done using your connection you are liable, regardless if you knew about it.

Did a residential proxy provider write this

I wouldn't call turning on CloudFlare's bot blocker an "absurd amount of effort" from the perspective of site owners.

But getting around it sure is annoying, sometimes I get flagged IP's from Comcast and can't visit sites like costco.com despite not doing any questionable stuff on my network.

Hard disagree. They are malware 99.9% of the time. The utility does not erase the fact they are abusive.

Residential proxies are a very important part of the internet

So important that we have to trick people into using them. Remember when folks were running SETI@Home? Of course you do, because it was widely thought to be a good thing, and folks willingly signed up.

How many would buy the "box" if the advertising were honest about what's actually in the box?

Most tools can be dual-use. Residential proxies are also used by malevolent actors to hack infrastructure or financial institutions and let some other poor soul get investigated for it. This is why we can't have nice things.

s/Residential proxies/DDoS networks/, then re-read your comment.

>absurd amount of effort every website is pouring into anti-scraping tech.

Maybe some people do not want to provide their entire website as free training material to [insert LLM lab here]?

Virtually all of it is the product of malware. This is like you saying that robbery is very important because you like buying cheap tools at pawnshops.