Half of LG Smart TV Apps Are Quietly Running Residential Proxies

Your living room television is, statistically speaking, fairly likely to be a node in someone else's proxy network. Spur Intelligence scanned 6,038 apps across LG webOS and Samsung Tizen platforms and found that 2,058 of them ship with residential proxy software baked in. That code quietly routes strangers' web traffic through the home internet connection the TV sits on, with no notice to the person who bought the set and no obvious sign anything is happening.

For anyone who runs bot defense for a living, this is not a curiosity. It is a supply problem. The residential IP addresses that make automated abuse so hard to filter have to come from somewhere, and smart TVs turn out to be a fat, underpoliced source.

Nearly half of the LG apps and more than a quarter of the Samsung apps in the sample contained a proxy SDK. These are not malware in the dramatic sense. They are libraries developers bolt onto otherwise normal apps, often in exchange for revenue, that turn the device into a relay. The traffic flowing through your TV is not yours. It belongs to whoever rented access to the proxy network, and they could be doing anything from scraping to credential stuffing to ad fraud.

The scale is what should bother defenders. A scan of two TV ecosystems alone surfaced more than two thousand affected apps. Multiply that by install counts across millions of households and you get a quiet, always-on pool of clean-looking residential addresses that almost no fraud team has accounted for.

Think about the properties a proxy network operator wants. A residential IP address that carries real reputational trust. A device that stays powered and connected for hours. An owner who will never inspect outbound traffic. A platform with weak update hygiene and almost no security tooling. A smart TV checks every box.

Phones get patched and watched. Laptops run security software. A television sits in the corner, on the same network as your laptop and your work VPN and your kid's school account, and nobody ever looks at what it sends. When a proxy SDK turns it into an exit node, the abuse it relays inherits the household's trust. To a server on the receiving end, the request looks like it came from a normal residential subscriber in a normal city, because it did.

That is the entire value proposition of residential proxy infrastructure, and it is exactly why IP reputation alone has stopped being a usable signal. The address is clean. The ASN is a consumer ISP. The geolocation is plausible. None of that tells you whether a human is behind the request.

Most bot defenses still lean hard on network-level signals. Block the datacenter ranges, score the IP reputation, rate-limit per address. That model assumed abuse came from infrastructure that looked like infrastructure. Smart TV proxy SDKs break the assumption from the inside.

When the exit node is a real home connection, several common controls degrade at once. IP blocklists miss it because the address has no history of abuse. Geofencing passes it because the location is genuine. Rate limits per IP barely bite because the operator rotates across thousands of households, sending a handful of requests through each. The traffic is distributed across the exact population you are trying to serve, which means any heavy-handed block hits real customers too.

The way we see it at TrustSig, this is the clearest argument yet for moving the question from where did this request come from to is there a human doing something coherent here. A residential IP tells you almost nothing now. The behaviour of the session, the timing, the interaction patterns, the consistency of the client, those are the signals that survive when the network layer has been laundered through someone's television.

There is a victim in this story who is not a fraud team. The person who bought the TV is now hosting traffic they cannot see and did not consent to. If that traffic is used for something illegal, it traces back to their connection first. They may hit CAPTCHAs and blocks on legitimate sites because their address quietly earned a bad reputation through no action of their own. They are paying for the bandwidth.

This is the cost that gets externalized when consent is treated as optional. A privacy-first posture is not a marketing line here. It is the difference between a defense that protects real people and one that punishes them for being raw material in someone else's network.

Residential proxies are no longer an exotic threat sourced from compromised routers. They are being manufactured at scale through ordinary consumer devices, sold as a developer monetization feature, and the IP addresses they produce look indistinguishable from your best customers. If your detection strategy still treats a residential IP as a trust signal, this research is your notice that the signal is gone.

Build for the world where the network layer lies. Score the human, not the address. The TV in the corner is already telling you why.