INTELLIGENCE  REPORT

FROM APP MARKETPLACES
TO PROXY INFRASTRUCTURE

ANALYSING RESIDENTIAL IP SOURCING ACROSS THE APPLICATION ECOSYSTEM

One residential proxy network. Seven days. 550+ threat groups, including state-linked actors. The devices were enrolled through everyday apps, mostly without consent.

What's inside:

• The SDK supply chain: from proxy operator to developer to enrolled device
• The consent gap: opt-in, buried in terms, or covert
• IPIDEA case study: Google's January 2026 disruption and why capacity migrated
• Enterprise exposure: enrolled devices scanned home networks, including routers, NAS and cameras
• Mitigations: for defenders, enterprises and individuals

By Sandra Cantero Rodríguez, Technical CTI Analyst, QuoIntelligence. Published September 2026.