When you purchase a residential proxy, you are essentially renting someone else's home connection. Whose connection it is and with whose consent is a question that ceased to be philosophical in 2026. In January, Google, along with its partners, dismantled the IPIDEA network, where addresses were collected, among other methods, through trojanized software and devices with hidden proxy code. Since September, AppEsteem, which maintains a public list of "deceptive" software, has been checking proxy operators monthly: what a client can do with minimal verification and whether the owner of the home IP suffers as a result.
Below is a comparison of four models through which operators acquire residential addresses, along with an analysis of ten requirements from the AppEsteem test: what pertains to the average buyer and how a "responsible" operator will differ from a "greedy" one in your tasks.
What Happened: Proxy Operators Are Being Tested Like Antivirus Software
AppEsteem registered a series called "AppEsteem 2026 Residential Proxy Operator Responsibilities Test Series" with AMTSO (the organization that sets antivirus testing standards). The test notification was published on September 21, 2026, and the results will be published in the AMTSO card on November 19, 2026.
From the published test plan (version 1.1 dated September 11):
- The test is ongoing and monthly. The first three Tuesdays of the month are training runs, the results of which are visible only to operators who have paid for this service. The fourth Tuesday is a scoring run for everyone, and its results are published for free. The first scoring run is scheduled for the fourth Tuesday of September 2026.
- Testing is conducted on behalf of the "least verified client" — an account registered at the lowest threshold allowed by the operator. For some, this is just an email and card, while for others, it already includes KYC.
- Each entry is checked separately: HTTP(S) proxies, SOCKS5 ports, and eventually "agent"/MCP interfaces. The reason is explicitly stated in the plan: an operator blocking a site via HTTP may sometimes allow it through their own SOCKS5.
- Consequences: a certified operator who violates their promises risks having their certificate reviewed or revoked; a non-certified operator who advertises "ethical" addresses but leaves them open to abuse risks being added to the Deceptor list. AppEsteem shares the results and this list with antivirus vendors and those protecting corporate networks.
An important detail: the question of consent (RPR-001, "ethical collection") is not included in this test — AppEsteem checks it separately as part of the certification. The new test is about something else: even a legitimately obtained address should not become a tool for attack.
Four Models of Collecting Residential IPs: A Comparison
According to the Google Threat Intelligence Group's report on the IPIDEA network and industry reviews, addresses enter residential pools through four main channels. They differ not only in ethics but also in how stable the pool is and how "dirty" the addresses might turn out to be.
1. "Earn from Traffic" Applications (Conscious Opt-In)
A person installs a program that pays or rewards bonuses for sharing their bandwidth. The consent is quite clear: the user understands why they installed the software. However, it is also important to consider whether the person can see what traffic will go through their connection and whether they can turn off sharing at any moment: explicit consent at installation does not guarantee honest usage afterward.
2. SDKs in Regular Applications
A developer of a game, utility, or content application embeds a monetization SDK, turning the device into an exit node. The SDK operator pays the developer — according to GTIG, usually for installation. The quality of consent depends on how the consent screen is presented: Infoblox noted in its June study that consent is often hidden in the user agreement, which no one reads. This is the largest and most vulnerable source: the pool can disappear in a day. In the case of IPIDEA, Google Play Protect began warning about applications with its SDK, removing them and blocking new installations on certified Android devices.
3. Free VPNs and Pre-installed Devices
A separate class consists of free VPNs that genuinely function as VPNs but also include the device in a proxy network, as well as uncertified TV boxes and cheap Android gadgets with hidden proxy code "out of the box." The report on IPIDEA mentions VPN applications like Galleon VPN, Radish VPN, and Aman VPN. There is essentially no consent here, and the pool survives until the first platform cleanup or firmware update.
4. Trojans and Botnets
The darkest option: the device is infected, and the owner is unaware. GTIG found 3,075 unique hashes of Windows files that contacted the controlling domains of IPIDEA, including binaries masquerading as OneDriveSync and Windows Update. Such addresses are usually already flagged in threat databases — and, more importantly for buyers, criminals operate nearby through the same network: according to Google, over 550 groups used IPIDEA exit nodes in one week of January 2026.
Summary Table
| Model | IP Owner Consent | Pool Stability | Risk of "Dirty" Address Reputation | Risk of Sudden Cleanup |
|---|---|---|---|---|
| Opt-in "Earn from Traffic" | Explicit | Medium | Below Average | Low |
| SDKs in Applications | From Explicit to Formal | High, until the SDK is banned | Medium | Medium-High |
| Free VPNs, Pre-installed Devices | Formal or Absent | Low | High | High |
| Trojans, Botnets | No | Unpredictable | Very High | Very High |
The ratings in the last three columns are our qualitative interpretation based on the described cases, not measurements. We have detailed how banning an SDK on a platform impacts the pool in our article about the ban on proxy SDKs in LG Smart TVs.
Ten Requirements from AppEsteem and What They Mean for Buyers
The test measures the operator's behavior based on ten points from the AppEsteem whitepaper (RPR-002 — RPR-011). For clients, they are divided into three groups.
Protecting Both You and the Address Owner
- RPR-002 — Clean Address. The operator must not allow the IP to be used for spam, fraud, or manipulation beforehand, rather than dealing with it afterward. For you, this means fewer addresses already flagged in anti-fraud databases.
- RPR-003 — No Illegal Traffic, malware domains, criminal sites, and forums with stolen data.
- RPR-005 — Traffic Only Outward. You cannot direct traffic back to the home network, to the router, to loopback, or open mail and remote desktop ports or UDP relays.
- RPR-010 — The Program is Isolated from the Device. It does not read the owner's passwords, cookies, and files, and your credentials are not read in transit.
- RPR-011 — The Software is Updated and Equally Protected on All Inputs.
Blocks That the Client Will Notice
- RPR-006 — Dangerous Categories are Closed by Default for any anonymous registration. The test plan includes examples of categories such as adult content, gambling, government sites, banks, crypto, streaming, games, tickets, and email.
- RPR-007 — Blocks Cannot Be Bypassed by minor address adjustments, "reflectors," or the operator's own SOCKS5 port.
- RPR-004 — Only Public Pages. For an unverified client, the connection must read what the site shows to everyone and not transmit logins, cookies, and tokens to restricted sections. The test checks logins, registrations, publications, and credential substitutions on a control site.
Transparency of Rules
- RPR-008 and RPR-009 — Published Rules (AUP) and a List of Exceptions with Reasons. The operator can grant access to restricted categories for verified clients, but only if the exception is published, the client has passed verification, and the address owner can see how their connection is being used. The plan states explicitly: without the third condition, identity verification protects "the operator's paperwork, not the consumer's."
The test also catches the reverse error — over-caution. If an operator blocks regular sites like news or encyclopedias, it is considered a failure: it means their blocks say nothing about the quality of protection.
What Will Change in Your Tasks
If the industry begins to adapt to this test, "responsible" and "greedy" operators will behave differently depending on the scenario.
- Parsing Public Data (prices, search results, catalogs, reviews). Nothing breaks: RPR-004 explicitly allows reading what the site shows to everyone. The gain is cleaner addresses and fewer CAPTCHAs due to neighbors in the pool.
- Multi-accounting, SMM, working in dashboards. The most sensitive area. Login, publication, and session cookies are exactly what RPR-004 prohibits for the "least verified client." This means that responsible operators will push such scenarios into verified plans with KYC and task descriptions. We compared which major providers have already tightened access in our review of KYC and usage rules among proxy providers.
- Email, messengers with non-standard ports, UDP. Mail ports and UDP relays from the home network are considered violations by the test. For such tasks, it is wiser to immediately use data center proxies or a server option where there is no home device that can be compromised.
- Banks, government sites, tickets, streaming. These categories are examples of default blocking. If your task is legal verification of localization or prices in these niches, be prepared to request a case description.
How to Check a Provider Right Now
The results from AppEsteem for specific operators have not yet been published, but you can ask any seller the following questions:
- Where do the addresses come from? Opt-in application, SDK, partnership with providers? Is there a public page about the owners' consent and how they can opt out?
- Is there a published AUP and a list of blocked categories? If there are no rules at all, it is not "freedom," but a signal that anyone could be operating in your pool.
- Do HTTP and SOCKS5 work equally? Check the same site through both protocols: a difference in accessibility is a sign of patched protection.
- How clean are the addresses? Run 10-20 issued IPs through reputation checkers and compare with a trusted connection. A high percentage of addresses marked "proxy/bot/fraud" indicates how the pool is filled.
- What will happen during a mass cleanup? Ask how many sources the pool is gathered from. One SDK means one day until a significant portion of addresses is lost.
For scenarios where a "live" home address is important — local issuance, ad verification, geo-pricing — choose residential proxies with clear rules and rotation tailored to the task, and for working with accounts requiring login, clarify in advance with the provider whether such scenarios are allowed.
Conclusion
The AppEsteem test is the first attempt to measure proxy operators like antivirus software: using a public methodology, monthly, with separate evaluations for the address owner and the client. For honest parsing of public data, this is good news: fewer dirty addresses and malicious neighbors. For multi-accounting and working with logins — a signal to prepare for KYC and task descriptions. The first public results are expected in November; until then, the best filter is the same questions about the origins of addresses and rules that the test itself poses.