Suzanne Kantra/Techlicious generated by ChatGPT
A growing number of apps promise to pay you for something you didn't know was valuable: your idle internet bandwidth. Install the app, let it run in the background, and earn a little cash while your connection sits unused. It sounds harmless, even smart. But new research from the Digital Citizens Alliance and cybersecurity firm risk3sixty found that criminal traffic was routed through some of these apps, and if the FBI investigates, that could lead agents to your front door.
The researchers uncovered the pattern by installing an app called Honeygain and watching their own connection for several days. What showed up was traffic linked to Tinkoff Bank, now operating as T-Bank, an institution sanctioned by the U.S. Treasury Department, suggesting T-Bank or a reseller working on its behalf was paying to route its traffic through an ordinary household's internet connection.
To Honeygain's credit, the investigators found no evidence that the company knows how its network gets used once it's sold. Honeygain isn't running a criminal operation; it built a business selling access to your internet connection and, as far as anyone can tell, doesn't check what happens to that access afterward.
Security firm Trend Micro reached the same conclusion in earlier research on Honeygain and similar apps. It documented shady and outright malicious activity moving through these networks, with no sign anyone was screening what got sent out. Trend Micro's term for this category of app is "riskware." Not quite malware, but software that offloads its risk onto you without ever showing you that risk exists.
Why is a residential IP address worth so much to a criminal?
Fraud detection systems have long worked on a simple assumption: traffic from a data center – the kind of large commercial server farm bots run from – is probably fake, so systems block it or challenge it. Traffic from a residential address – the kind Comcast or Verizon assigns to an actual house – is probably a real customer, so it gets waved through. That gap between how the two are treated is what makes your home internet address valuable to criminals. Route their activity through a real home connection, and they look exactly like the ordinary people that fraud systems are built to trust.
That's what fuels a growing underground market where criminals rent access to home internet connections the same way they'd rent server space, and apps like Honeygain feed directly into it. The investigators tested seven companies that sell this kind of access and found that, on average, 85 percent of the connections being sold had already been flagged for fraud or suspicious activity by IPQualityScore, a tool companies use to check whether an internet address has a history of scams or abuse. Over 80 percent of those flagged connections traced back to homes rather than data centers.
If you or your kids are running Honeygain or a similar app for pocket money, I recommend uninstalling it. You have no way of knowing who's using your connection or for what. If your home internet address ever gets tied to fraud or a stolen-login scheme, the trail leads back to your name, not to whoever paid for the access.
It only takes seconds to check whether your home’s IP address is currently registered as a proxy node. Spur, an internet intelligence firm, offers a free public tool at spur.us/me that checks whether your home IP address is currently registered as a proxy node. GreyNoise IP Check provides a similar analysis. If your address shows up as a known proxy node, look for and uninstall passive income apps, and run the test again to confirm your IP is no longer showing as compromised.
Read next: The Best antivirus software 2026: free and paid picks
