Reputation Radar #8: Reputation You Can Borrow

There's a quiet assumption baked into a lot of reputation checks: a residential IP is probably fine. It belongs to someone's house, their phone, their car. Nobody runs a serious operation from a home broadband line, so the thinking goes, and the address inherits a bit of trust just by looking domestic. Two stories this week are worth sitting with because they both turn on exactly that assumption. In each one, the traffic you'd see leaving is riding through a device that really does belong to an ordinary person. The person just didn't agree to it, or didn't understand what they agreed to.

The car that's quietly a proxy

Kaspersky attributes a fresh wave of the BadBox botnet to a group it tracks as MoYu, and the new twist is the target: Android head units, the infotainment computers bolted into cars (The Record). The way in is almost boring, which is what makes it good. There's a legitimate system app on these units called TWCore that handles analytics and updates, and the malware rides in through it, then pulls down more code with no tap or prompt a driver would ever see.

The part that matters for us is what one of the modules does once it's home. It turns the head unit into a reverse proxy, so that, in the researchers' words, "other people's internet traffic" gets routed out through the car's connection and looks like it came from there. This is the same crew that already shipped malware pre-loaded on more than seventy thousand phones, TV boxes and tablets, and got knocked offline in late 2024 only to come back. So picture the alert on the other end: a connection arriving from a normal mobile carrier IP, geolocating to a normal city, attached to a normal consumer plan. Everything about the address says regular person. None of it is the regular person.

The same trick, sold as a service

The unsettling companion piece is that you don't need a botnet to get here. Silent Push took apart Peer2Profit and AstroProxy, a pair that runs the legal version of the same idea (Cyberpress). People install an app that pays them a little to sell their spare bandwidth, roughly a quarter per gigabyte, and the company resells that same traffic to customers for many times more. What you're buying, if you're the customer, is the right to exit the internet through a stranger's home connection.

The number that stuck with me isn't the size of the pool, it's the speed. Over three days the researchers counted well over a hundred thousand exit addresses, with something like a thousand brand-new ones showing up every hour. When the addresses churn that fast, a reputation score on any single one of them barely has time to mean anything before it's a different house. And there's a nastier edge: they found a way to point one of these proxy nodes back at the router it was living behind and reach its admin page from outside. So an employee running one of these apps on a work laptop isn't just leaking a bit of bandwidth, they may be opening a door into the office.

We wanted to see how our own API handles a traffic-routing exit, so we asked it about a live one, the Tor node 185.220.101.1. It comes back investigate, not benign, and the note it returns is the honest one: traffic to or from here "could originate from anywhere in the world," so check the direction before you decide anything. Outbound to an anonymizing exit reads very differently from inbound. A residential proxy pool is the same shape of problem wearing friendlier clothes, and it deserves the same reflex: the exit address is telling you where the packet left, not who sent it.

The thread for a SOC

The tidy version is this. For a rented home IP, a reputation lookup answers the question "is this address itself hostile," and the answer is usually no, because it's a real person's real connection. That's a true answer to the wrong question. The one you actually care about is whether a legitimate address is being used to launder someone else's traffic right now, and that's not something the IP can tell you on its own. It shows up in direction, in volume, in whether a home connection is suddenly acting like a server.

Which is why we don't let "residential" or "consumer ISP" quietly round up to safe, and why we keep the proxy, VPN and anonymity tags visible on an address instead of smoothing them away. If an IP can plausibly be an exit for someone else's traffic, the useful thing we can do is say so and tell you what to look at next, rather than hand you a green light you'd have to walk back.

Also on the radar

• A set of npm packages used a CDN as free hosting for a phishing page. OX Security found two dozen packages that do nothing for a developer who installs them, and that's the point: the attackers were using npm's public mirrors, served from unpkg.com, as a trusted place to park fake Cloudflare CAPTCHA pages (The Hacker News). Pull the package from npm and the copy on the mirror lingers, so the phishing keeps loading from a domain everyone waves through.
• Researchers showed how the big CDNs can be turned into amplifiers. A paper on what the authors call CDN Tsunami describes how translating modern HTTP/3 requests down to older HTTP/1.1 lets a small request balloon into a much larger one at the origin (The Hacker News). It's a research finding for now, with no CVE and nothing seen in the wild, but it's a good reminder that the network you lean on for protection can be pointed the other way.
• A Linux botnet wired an AI model into its control loop. A peer-to-peer botnet called ToxNetV2 sends a rundown of each infected machine off to a hosted inference service and uses the reply to pick its next move, with the operator still approving the risky ones (Cyberpress). The interesting bit is the pattern, not the polish: it's leaning on a legitimate AI service to do its thinking, the same way this week's other stories lean on legitimate homes and CDNs to do their hiding.

If you want the longer version of why a legitimate address is context and not a verdict, we walked through the cloud version of it in when the phishing page lives on Google's servers.

See you next week.

Sources are linked inline; credit to the original researchers and reporters. If we got a detail wrong, tell us and we'll fix it.

About Reputation Radar: This is written by the small team building Reput.io, not a marketing department. It's our weekly read on the infosec landscape, with a bias toward the thing we care most about: how attackers borrow the reputation of legitimate infrastructure so their traffic looks normal. Every item links the original reporting, and any claim about our own API is run against it live and labelled.