What these apps are
Bandwidth-sharing apps, often called proxyware, pay a user a small amount for letting the app route other people's traffic through their internet connection. The company behind the app sells that capacity on to its own customers as a proxy service. Because the traffic comes out of ordinary homes and offices, it's usually sold as "residential" proxy traffic: it looks like a real person on a real connection, not a data center.
Some are installed on purpose. Well-known examples include Honeygain, EarnApp, Pawns.app, Peer2Profit, Repocket, Traffmonetizer, PacketStream and Grass. Others arrive quietly: a few proxy companies offer software development kits (SDKs) that app makers bundle into free apps, games and browser extensions in exchange for payment. Bright Data's and Infatica's SDKs are two examples. The person using the free app may have agreed to it in a settings screen without really noticing.
Researchers at Cisco Talos have also reported malware that installs a legitimate proxyware client in the background, so someone else collects the payments. Talos recommends treating proxyware like cryptocurrency mining software: as a potentially unwanted program.
Why it matters for a business
The app's owner gets paid a little. Everyone else on the network carries the risk:
- Your IP address is used for traffic you didn't send. Proxy customers can be anyone. Residential proxies are popular for large-scale scraping, ad fraud, sneaker and ticket bots, and credential stuffing (trying stolen passwords against login pages). To the website on the other end, all of it comes from your office.
- IP reputation suffers. Addresses that send abusive traffic end up on blocklists. Staff start seeing CAPTCHAs on every search, logins get challenged, email can be treated with suspicion, and some services refuse the connection outright.
- Abuse reports land on you. If someone uses your connection for something illegal, the abuse complaint goes to your internet provider, and from there to you. You then have to show it wasn't your staff.
- Bandwidth is used without anyone knowing. On a small office line, a few devices sharing their connection all day can be noticeable.
- Policy and compliance. Most acceptable-use policies forbid reselling the company's connection, and many contracts and security frameworks expect you to know what's running on your network. An unknown app relaying outside traffic is hard to explain in an audit.
It doesn't need to be a company laptop. A personal phone on the staff Wi-Fi, a smart TV in the break room or a guest's tablet can do the same thing.
How to find and stop them
- Block the check-in domains, not the vendor websites. These apps have to contact their company's servers to sign in and receive work. Blocking those lookups at DNS stops the app from sharing the connection, on every device at once, without software on each one. Target the check-in hosts where they're known, so people can still read the vendor's website or support pages. Avoid blocking shared CDNs as a whole, which would break unrelated sites.
- Alert on attempts. A blocked app keeps trying. Repeated blocked lookups are the clearest sign that something on the network has one installed, so make sure someone actually sees them.
- Find the device. Use your DNS query logs to see which internal IP made the lookups, then match it to a device with your DHCP leases or firewall. If you use device groups or separate guest Wi-Fi, that narrows it down quickly.
- Remove the app. Uninstall it, and check whether it came bundled with another free app or extension that should go too. If nobody installed it on purpose, scan the device for malware.
- Write it into policy. Add bandwidth-sharing apps to your acceptable-use policy, next to personal VPNs and crypto miners, and block installs with device management where you can.
Like any DNS control, this only covers lookups that reach your filter. If a device uses its own DNS or a VPN, see how to stop devices bypassing DNS filtering.
See if a domain is on the list.
Check a websiteHow DNSAFE handles it
DNSAFE keeps its own list of bandwidth-sharing apps and proxy SDKs, because no maintained public list exists. Entries come from public sources, and the list targets the apps' check-in hosts where those are known, so the vendor's website keeps working.
- Blocked by default on every plan, Home and business, at no extra cost.
- Business and MSP owners get an alert naming the network when a device on it keeps trying to reach one of these apps, at most once a day per network, through their normal notification channels (the portal, email, Slack or Teams). Home accounts get a similar notice.
- Blocked lookups show in the query logs as
block_proxyware, with the source IP, so you can find the device. See the query log reference. - A network can switch it off on its Protection tab, for example a lab that tests these services. On Home plans, someone who uses one on purpose can switch off Bandwidth-sharing apps on the Protection page. See the Home guide.
- Check any domain on the website check: if it's on the list, the verdict says it's blocked by default as a bandwidth-sharing app.
For MSPs, the alert is a useful conversation starter with a client: something on their network was renting out their connection, and it has stopped. See DNS filtering for MSPs.
Frequently asked questions
Are bandwidth-sharing apps illegal?
Generally not. They're legitimate products, and the person running one agreed to the terms. The problem for a business is that the person who agreed usually isn't the person responsible for the network, and the traffic still leaves from the company's IP address.
Will blocking them break the app maker's website?
It shouldn't. DNSAFE blocks the apps' check-in hosts where they're known, rather than the whole company, so the website and support pages keep loading. For a few small apps whose check-in host isn't public, the whole domain is blocked.
How do I know if one is running on my network?
Look for repeated blocked lookups to these apps in your DNS logs. On DNSAFE they're logged as block_proxyware, and the network owner gets an alert when a device keeps trying.