My television has one job. It plays Netflix while I scroll through my phone and fail to pay proper attention to either screen. Until recently, I thought this was the only questionable arrangement in the room. 

I had not considered that a television, streaming box or even a digital picture frame could also be lending my internet connection to somebody I have never met. Not necessarily stealing my passwords or watching me through a camera. Simply allowing a stranger’s online activity to appear as if it came from my home. 

This does not mean my television is infected. I have no evidence that it is. However, the possibility that an ordinary household device could become somebody else’s disguise is no longer confined to cyber thrillers. 

In March, European authorities dismantled SocksEscort, a service that had allegedly compromised more than 369,000 routers and connected devices across 163 countries. According to Europol, the devices were used to conceal criminal activity including ransomware and distributed denial-of-service attacks. 

The owners generally had no idea. 

Investigators found that the network had been built largely through a vulnerability in residential modems belonging to a particular manufacturer. The routers continued performing their ordinary household duties while also quietly routing somebody else’s traffic. 

This is the unsettling idea behind a residential proxy network. 

Every home internet connection has an IP address. When I open a website, that address helps identify the internet provider and approximate location from which the request came. A residential proxy allows somebody elsewhere to borrow that address, making their activity look as though it came from an ordinary household rather than a distant server. 

The attraction is not the television, router or streaming box itself. It is the address attached to it. 

Residential proxies have legitimate uses, including advertising checks, market research and website testing. The problem begins when the household connection has been obtained through malware, an insecure device or consent buried inside conditions few people understand. 

It is the digital equivalent of allowing a stranger to send letters with your return address printed on the envelope. 

Imagine that stolen banking credentials belong to somebody in Limassol. An attempted login from a suspicious overseas server might immediately attract attention. A connection that also appears to come from Limassol may look far more ordinary. 

Meanwhile, the real owner of the internet connection may know nothing until websites begin blocking the address, the provider sends a warning or investigators start asking questions. 

The household is not always the intended victim. Sometimes it is simply the perfect alibi. 

There is no verified Cyprus figure showing how many homes on the island have been drawn into residential proxy networks. Commercial proxy companies advertise access to Cypriot addresses, but their claims do not reveal where those addresses came from or whether their owners knowingly agreed to participate. They cannot be treated as evidence that thousands of local homes are infected. 

However, Cyprus is hardly disconnected from the risk. Eurostat data showed that 94 per cent of Cypriot internet users watched television or videos online in 2024, one of the highest proportions in the EU. 

The island has not necessarily been singled out. It simply uses the same internationally sold routers, television boxes and apps found in homes everywhere else. 

One of the clearest European warnings came from Germany. Its federal cybersecurity authority found around 30,000 media players and digital picture frames communicating with the BadBox botnet. The devices had not become infected because their owners clicked a suspicious email. They were already infected when they were bought. 

The malicious software had been inserted into their firmware, allowing the devices to create accounts, commit advertising fraud and operate as residential proxies. German authorities blocked communication with the botnet’s control servers, but the episode exposed the limits of familiar cybersecurity advice. 

Avoiding suspicious links cannot protect a television box compromised before it enters the house. 

Google later said its BadBox investigation had uncovered more than 10 million uncertified devices running Android’s open-source software. They included internet-connected televisions and streaming equipment sold without the security protections available on certified Android devices. 

The distinction is easy to miss. A television box may display familiar apps, use the Android name and work perfectly well while lacking the safeguards people assume are present. 

In other words, the suspicious device may not look broken. It may look like an excellent bargain. 

The subject became even more immediate this month. On July 2, Google announced action against NetNut, a residential proxy network it estimated contained at least two million devices worldwide. 

During a single week in June, Google observed 316 cybercriminal and espionage groups using suspected NetNut addresses. It warned that a household connection could become a “launchpad for hacking”, while an infected device might also expose other equipment using the same home network. 

Google disabled accounts and services associated with the operation and configured Play Protect to warn users about apps known to contain NetNut software. It said the intervention reduced the network’s available pool by millions of devices. 

NetNut’s parent company, Alarum Technologies, initially said it would cooperate with investigators over any misuse of its infrastructure. In a July update, it said the exact cause of the disruption remained unknown, an external cybersecurity and forensic team had been appointed and no final conclusions had been reached. The company was considering a controlled restoration of services following additional legal, technical and compliance reviews. 

The distinction matters because residential proxy services occupy an uncomfortable space between legitimate technology and criminal exploitation. Some people knowingly agree to share their internet connections. Others have no idea. 

The grey area lies somewhere in between. 

A free VPN may mention bandwidth sharing deep inside its conditions. An app developer may be paid to add proxy software to an otherwise ordinary programme. A service promising passive income may offer a small payment in exchange for “unused internet”, without making it clear who will eventually use that connection. 

Permission may technically exist while real understanding may not. 

The latest Cyprus survey from the Digital Security Authority suggests that awareness is improving but remains uneven. In 2025, 56 per cent of respondents said they used two- or multi-factor authentication. At the same time, 15 per cent reported taking none of the recurring measures listed to protect their devices and data. 

Even careful users face a difficult problem when the weakest point is not a password or suspicious message but a forgotten streaming box beneath the television. 

Europe is beginning to place more responsibility on manufacturers. Under the Cyber Resilience Act, companies selling connected products will eventually have to meet security requirements throughout a product’s lifecycle and address vulnerabilities during the support period. 

The first major stage is now less than two months away. From September 11, manufacturers must report actively exploited vulnerabilities and serious security incidents, with an initial warning required within 24 hours. Most of the wider obligations will apply from December 2027, according to the EU timetable. 

“From baby monitors to smart watches, digital elements are part of our daily lives,” European Commission Executive Vice-President Henna Virkkunen said when draft guidance was published in March. 

Consumers, meanwhile, still have to make decisions now. 

The useful precautions are not particularly glamorous. Routers, televisions and streaming boxes should receive security updates, while products that no longer receive manufacturer support deserve suspicion. Default administrator passwords should be replaced and remote access disabled unless it is genuinely needed. 

Connected household devices can also be placed on a separate guest network, away from computers and phones containing work files, banking information and personal photographs. 

On Android equipment, the Play Store settings show whether a device is Play Protect certified. Google also advises people to avoid unofficial app stores, unclear free VPNs and services offering payment in return for “unused bandwidth”. Free internet services do not always ask for money. Sometimes they ask for the internet itself. 

It is also worth opening the router settings and checking the list of connected devices. The entries should correspond to things we recognise: phones, computers, televisions, cameras and perhaps one printer that has spent several years refusing to print. 

Anything unfamiliar deserves investigation. 

A factory reset may remove an infected app. It may not remove malicious software installed in the firmware. When a device cannot be updated, verified or properly cleaned, the safest answer may simply be to disconnect it. 

I am not planning to throw my television out. I am, however, beginning to see the small “connected” label on household products differently. It once sounded entirely positive, as though internet access automatically made an ordinary object cleverer. 

Now it also raises a question. Connected to whom? 

We tend to protect the obvious things in our homes, including our money, passwords, photographs and personal information. A residential proxy takes something less visible. It borrows the credibility of an ordinary household and gives it to somebody who needs to appear harmless. The stranger does not have to enter the house. To the rest of the internet, they are already home.