From Bulletproof Hosting To Proxy Networks

For decades, criminals relied on so-called bulletproof hosting: web servers in permissive jurisdictions that ignored takedown notices and law enforcement requests. Bulletproof hosts leased space to criminals and “turned a blind eye” to illicit content such as spam, malware command servers, or banned data.

However, that model is fading. Global law enforcement has increasingly targeted these hosting providers, seizing servers and indicting operators. As a result, experts say cybercriminals are abandoning dedicated illicit servers in favour of proxy networks that obscure their traffic.

Longtime researcher Thibault Seret notes that after police cracked down on bulletproof hosts, both criminals and their service providers “migrated to an alternative approach,” using proxies and VPNs to hide malicious traffic. Today’s proxy services rotate and blend customer IP addresses, often without keeping logs.

Seret told WIRED that in such a system, “you cannot technically distinguish which traffic in a node is bad and which traffic is good, because all traffic looks the same to the outside observer.”

In short, once an attacker’s data merges with normal web use, separating the two becomes a nightmare.

Residential Proxies And Consumer Devices

A key tool in this shift is the residential proxy. Unlike a traditional VPN or datacenter proxy, a residential proxy uses real IP addresses assigned by internet service providers (ISPs) to home or office devices.

In practice, this means the proxy network is built on ordinary gadgets: old Android phones, personal laptops, smart routers, and even voice assistants or smart TVs. Malware or proxy apps (sometimes installed without the owner’s knowledge) turn these devices into exit nodes. The result is a decentralised network of endpoints that resemble everyday internet users.

Think of it like this: instead of sending malicious traffic from a suspicious data centre IP, the attack is routed through a random person’s internet connection in, say, Ohio or Spain. To a website or security scanner, the request appears to originate from a legitimate household.

As Trend Micro researchers explain, “A residential proxy is a proxy on an internet-connected device… configured to provide connectivity for third parties,” often without the owner’s awareness.

In effect, criminals “rent” these hundreds of millions of IP addresses to disguise their actions as normal browsing.

This disguise is highly effective. Residential proxy services offer “real, rotating IP addresses assigned to homes and offices… that can run on consumer devices, even old Android phones or low-end laptops.” Such networks offer strong anonymity and can shield malicious traffic by blending it with benign data.

Attackers exploit this to bypass corporate and government scanners. In Seret’s words, “the magic of a proxy service… is you cannot tell who’s who.”

Malware connections now ride along with innocent chat, video calls, or streaming traffic, making red flags nearly invisible.

Modern residential proxy tools even let criminals target specific locations. Reports on the NSOCKS network show it offered proxies by state, city, or even ZIP code. Buyers could purchase a few hours of access (for just a few dollars) to proxy servers in, say, California, and carry out targeted spam or login attacks without raising suspicion. And because these proxies run on home devices, most are never flagged as malicious by security firms.

Cybersecurity firm Lumen Black Lotus Labs found that only about 10% of infected router-based proxies in a large botnet were detected by VirusTotal scanners. This means the other 90% “consistently avoid network monitoring tools with a high degree of success.”

Botnets And Proxy Marketplaces

Behind many residential proxies are botnets of compromised devices. Malware recruits large groups of routers, IoT gadgets, and PCs. One example is the Ngioweb trojan, which has infected tens of thousands of routers and IoT devices worldwide. In late 2024, researchers at Lumen and Cisco Talos reported that Ngioweb was the engine behind NSOCKS, a notorious proxy service.

At least 80% of NSOCKS’s 35,000 active proxies came from devices controlled by the Ngioweb botnet. These machines were then “rented out” on proxy marketplaces, allowing buyers to select exit nodes by city, ISP, or device type. In doing so, they could choose exactly where and how their traffic would appear to originate.

This model has become a lucrative business. The now-disrupted AnyProxy and 5socks services are prime examples. Operating since the early 2000s, they ran botnets of old routers and sold subscriptions granting proxy access to other criminals. In a 2025 FBI-led takedown (Operation “Moonlander”), authorities seized these networks.

Court filings reveal the operators built two proxy networks by infecting thousands of home routers worldwide since at least 2004. They advertised roughly 7,000 proxy IPs and collected around \$46 million in subscriber fees over the years. In essence, a lone criminal could pay a monthly fee and have their traffic routed through dozens of real home IPs, thereby hiding their own device’s identity.

These cases show how consumer devices are being weaponised. Often, the targeted hardware is beyond its support life: old “end-of-life” routers or outdated smart gadgets with known vulnerabilities. Criminals exploit these weaknesses to install proxy malware.

As one Lumen report put it, the malware “steals bandwidth… without impacting end users” to create a stealthy proxy service. The average consumer might not even notice anything amiss. But from a security standpoint, this vast pool of home-based IP addresses is a goldmine for attackers.

The Law Enforcement Challenge

All these advances present a growing challenge for defenders. Traditional security tools rely heavily on IP reputation and traffic patterns. But if malicious traffic blends in with legitimate user behaviour, automated tools struggle to distinguish it. Seret notes bluntly that even large datasets can’t untangle good from bad traffic in these mixed nodes. And because residential proxies use so many different ISPs and geographic locations, an organisation’s blacklist of “bad” IPs becomes far less effective. A Trend Micro study explains that the wide availability of legitimate-looking home IPs has “diminished” the value of blocklists, forcing a shift toward more sophisticated detection methods.

For investigators, attribution becomes a maze. Ronnie Tokazowski of Intelligence for Good points out that if an attack appears to come from the same IP range as a company’s employees, it’s nearly impossible to determine who’s behind it.

In practice, law enforcement often ends up chasing ghosts. Takedown requests to internet service providers are futile when the “bad” traffic routes through dozens of unwitting participants. Even when proxy networks are exposed, dismantling them does not solve the underlying issue. Proxies have become a fundamental part of the internet, used by everyone.

Some progress has been made through international operations. The FBI and other agencies have disrupted major proxy botnets and charged their operators (as with AnyProxy and 5socks), but new ones emerge quickly.

Each takedown reveals only part of the bigger picture. After Moonlander, for instance, Lumen’s analysts warned that similar networks remain hidden, often “cloaked” within ordinary traffic. And because many proxies reside on equipment whose owners have long since stopped updating it, the problem persists at the root of the consumer internet.

A Digital Arms Race

The rapid rise of residential proxy abuse underscores a simple reality: the tools available to criminals are evolving faster than defenders’ playbooks. Cybercriminals have created an invisibility shield that even sophisticated security operations struggle to penetrate. By turning millions of homes into unwitting traffic mixers, they’ve gained the upper hand.

Experts caution that stopping this trend will not be easy. There are no quick fixes. Seret stated that even shutting down one proxy service will not end the problem, because new ones can quickly emerge using fresh devices.

In the meantime, organisations and law enforcement must adapt. Analysts recommend strengthening endpoint defences—by securing routers, IoT devices, and employee hardware—and developing more advanced behavioural analysis to detect anomalies beyond just IP addresses.

Until those defences catch up, much of the internet’s dirty work will remain hidden in the crowd of ordinary traffic. As one cybersecurity team put it, malicious activity “could be hiding right under our noses, disguised as ordinary digital life.”

The post IF Insights: How cybercriminals mask malicious web traffic appeared first on International Finance.

In 2011, Xiaomi introduced its first smartphone and by 2014, Xiaomi had the greatest market share of smartphones sold in China. In the beginning, the company mostly used to sell its product online. However, it later developed physical stores in the country. By 2015, the company was creating a variety of consumer gadgets. The business sold 146.3 million smartphones in 2020, and MIUI, its mobile user interface, has more than 500 million active monthly users.

According to Counterpoint, Xiaomi will be the third-largest smartphone seller in the world by the end of 2023, with a 12% market share. Xiaomi is also a major manufacturer of appliances including televisions, flashlights, unmanned aerial vehicles, and air purifiers. The company is expanding its domestic product line-up with its Internet of Things and Xiaomi Smart Home product ecosystems.

Xiaomi keeps its prices close to its production expenses and bill of materials costs. It also keeps most of its products on the market for 18 months, longer than most smartphone manufacturers. The company also uses flash sales and inventory optimization to maintain minimal inventories.

In 2021, Xiaomi was placed second worldwide in the evaluation of WIPO’s annual Global Intellectual Property Indicators, with 216 designs in industrial design registrations up from their previous third-place ranking in 2019. As per the 2022 first quarter report, the company was leading Indian smartphone sales. It is one of the top smartphone manufacturers in India that keeps product prices low.

In 2022, Xiaomi unveiled the company’s first humanoid robot prototype to the public. The announcement marked the company’s ambitions to integrate AI into its product designs as well as develop its humanoid robot project in the future.

The brain behind this successful consumer electronics company is a 53-year-old Chinese billionaire entrepreneur and philanthropist Lei Jun. He is the Founder and CEO of Xiaomi with an estimated personal net worth of around USD 8.1 billion. According to the Bloomberg Billionaires Index, he is the 203rd richest person in the world.

Who is Lei Jun?
• Lei Jun was born in Xiantao, in the underdeveloped countryside of Hubei, China
• He completed his bachelor’s degree in computer science from Wuhan University in 1991
• In 1992, Lei Jun joined the Beijing-based software company Kingsoft Corporation, and by 1998, he became the CEO
• He founded Joyo.com, an online bookstore, which he sold for USD 75 million to Amazon in 2004
• In 2007, Lei Jun resigned as the president and CEO of Kingsoft for health reasons and in 2010, founded Xiaomi
• Lei Jun co-founded Shunwei Capital in 2011, an investment firm through which he makes investments in the e-commerce, social networking, and mobile sectors
• The same year he joined Kingsoft as Chairman
• Lei Jun was named Businessman of the Year by Forbes in 2014 and 100 most influential people in the world by Times Magazine
• In 2018, he oversaw the company’s Initial Public Offering (IPO), which raised about USD 3 billion
• Lei Jun had donated USD 1 billion to charities, starting with a ¥140,000 donation in 1997 to Wuhan University, later in 2021, he also donated over USD 2.2 billion worth of Xiaomi shares

Lei Jun On Xiaomi

In an interview given to ExamineChina in 2015, Lei Jun talks about Xiaomi and its market journey.

Lei Jun said, “Around 7.4 million pre-orders of a budget Red Rice phone prove that Xiaomi is a big player in the Chinese smartphone market. In Q2 2013, it outclassed Apple, reaching 5% of the market share. It is still lower than big companies such as Samsung, Lenovo or Huawei, but Xiaomi entered the market no sooner than in 2011. By October 2013, Xiaomi was the fifth most-used smartphone brand in China. In Q2 2014, Xiaomi shipped 15 million devices, around 14% of China’s market share, meanwhile, Samsung shipped slightly more than 13 million.”

As of today, Xiaomi continues to dominate the smartphone market. The company has a market share of 21% during Q3, 2022, shipping 9.2 million units. The annual growth rate, however, was down by 18% as the company shipped 11.2 million units during the same quarter, 2021, according to a report by Canalys.

The post Business Leader of the Week: Meet Lei Jun, Xiaomi’s guiding force appeared first on International Finance.

Banks’ Websites
In the 1990s, web-based services became popular. The earliest mobile banking services, which used SMS and WAP for essential account services, also came into existence around the same point in time.

However, things took off with the introduction of the smartphone and app-enabled banking in the 2010s. People used a combination of web and mobile channels for most of that decade.

Around 80% of customers say that today, their access their bank accounts through smartphones. However, banks are experimenting with cutting-edge technologies like wearable gadgets for transfers, notifications, and alarms, to stay ahead in the race.

Commercial Lines
With retail banking, business line change first began. This was caused mainly by the proliferation of challenger banks and fintech startups providing attractive services, but open banking’s introduction in 2016 gave it a substantial boost.

SME banking, fueled by the rise in gig economy employment and startups in the 2010s, was the second banking sector to transform. Fintechs have taken the lead in this sector since traditional banks underserve this market.

Wealth management, a branch of banking that has continued to use manual procedures into the current decade, is the driving force behind SME banking.

However, lockdowns prompted by COVID-19 were the main factor in the business line’s virtualization. As a result, over half of financial managers in the US and UK have boosted their usage of digital technologies post-COVID.

Corporate banking is the most digitally backward sector. However, as businesses expect from their bank’s digital experiences that match the data and AI-enabled apps they are accustomed to in other parts of the company, change is already beginning. Financial institutions’ future success in modernizing corporate banking will depend on their capacity for innovation, client satisfaction, and market share.

Key Lessons
This condensed history of banking’s digital transition offers crucial insights for future innovation. Advancements can only be made when banks’ needs, technological advances, and client needs are all combined. Future initiatives should focus on business drivers and intended outcomes rather than concentrating solely on technology enablers. The banking industry of tomorrow will be created at this intersection.

The post Banking sector 2023: What to expect? appeared first on International Finance.