Is my phone being used as a proxy? How to check, and how to stop it

Two different questions hide behind this one. Either your phone sends its own traffic through a proxy or a VPN that someone set up, as a setting, an app or a profile; or your phone, or another device on your Wi-Fi, passes strangers’ traffic through your connection, because an app rents it out or the device came with proxy software inside. The first takes a minute in Settings. The second takes a little detective work, and it is the one investigators have found on millions of devices. Below: how to check both, the signs the investigators actually list, and how to stop it. The outside facts were checked on 20 October 2026.

Is my phone using a proxy? Check the settings

On an iPhone:

• Wi-Fi proxy. Go to Settings, tap Wi-Fi, then the Info button next to your network; that screen is where you “Configure DNS, HTTP Proxy, and other network settings” (Apple Support). A proxy there that you did not set up is worth asking about.
• VPNs and profiles. Go to Settings, General, VPN & Device Management. “If you don’t see any profiles, then no device management profiles are installed on your device.” To remove one, “Select the profile, tap Delete Profile, and follow the onscreen instructions”, then restart; a profile installed by an employer or a school may not let you (Apple Personal Safety User Guide). While a VPN is connected, a VPN icon shows in the status bar (Apple Support).
• Anything else. Apple suggests you “search within settings for these words: VPN, profile, firewall, and filter”, and warns that a removed setting “might return later” if the software that created it is still in use (Apple Support). Reset Network Settings, under General, Transfer or Reset iPhone, Reset, removes the VPN settings that a profile or device management did not install (Apple Support).

On Android the steps below are Google’s, for Pixel phones; other makers move the menus, and Google’s advice is to “Get help with your specific device on your manufacturer’s support site” (Android Help):

• Wi-Fi proxy. A proxy is set separately for each Wi-Fi network: “Tap Network & internet › Internet. Tap a network. Tap Edit › Advanced options.” The Proxy setting is under Advanced options (Pixel Help).
• VPN. Settings, Network & internet, VPN lists the VPNs on the phone, with an Always-on VPN switch for the ones not set up through an app (Android Help).
• Apps with control of the phone. Under Settings, Security, the Device admin apps screen lets you “Find or remove apps that can administer your phone” (Pixel Help).

A proxy or VPN that you, your employer or your school set up on purpose is not a problem. One you cannot explain is.

How a phone ends up working as a proxy for strangers

A residential proxy service sells its customers the use of ordinary home and mobile connections, so that their traffic looks like yours (what a residential proxy is). Those connections come from somewhere, and four routes are documented.

1. An app that pays you to share it. Some apps say exactly what they do. With Honeygain, “a share of your idle bandwidth goes to vetted business partners who route everyday web traffic through your device”, for price comparison, ad verification and public web data collection, and Honeygain estimates the pay in the US, UK or Western Europe at “around $3 to $10 a month on one device”; it has apps for Windows, macOS, Linux and Android, not for the iPhone (Honeygain). EarnApp says it “is backed by Bright Data” (EarnApp) and that it uses your IP address “to download a few web pages in the background”, which are “sent to Bright Data’s customers” (EarnApp terms). PacketStream pays “$0.10 for every GB of traffic” that passes through its desktop app (PacketStream) and sells “Residential bandwidth at $1/GB” (PacketStream). Pawns.app says: “As of 2026, Pawns.app does not offer internet bandwidth sharing.” (Pawns.app), while it still offers app makers an SDK that “enables integration with residential proxy network by leveraging user bandwidth”, paying $0.20 per GB (Pawns.app SDK).

2. An ordinary app with a proxy hidden inside. More often the proxy comes inside an app that does something else. Google’s Threat Intelligence Group found that software kits from the IPIDEA network, handed out to app makers, “surreptitiously enroll user devices into the IPIDEA network” while the app goes on doing its job. It counted “over 600 applications across multiple download sources”, most of them “largely benign in function (e.g., utilities, games, and content)”, and free VPN apps that “join the device to the IPIDEA proxy network as an exit node” without clear disclosure (Google Threat Intelligence Group, January 2026). In July 2026 it reported another network, NetNut, estimated at “at least 2 million devices”, which spreads through kits for “devices commonly found in homes, such as smart TVs and streaming boxes” (Google Threat Intelligence Group, July 2026). In 2024 HUMAN found free VPN apps on Google Play that “transformed the user’s device into a proxy node without their knowledge”; Google removed 28 of them (HUMAN).

3. A cheap device that came infected. BADBOX 2.0 ships on off-brand Android devices as “a preinstalled app that activates once the device is powered on”. HUMAN counted “more than 1 million devices worldwide” in early 2025, none of them “Android TV OS devices or Play Protect certified Android devices” (HUMAN); Google later put it at “over 10 million uncertified devices” when it sued the operators (Google). The FBI names the kinds of device: “TV streaming devices, digital projectors, aftermarket vehicle infotainment systems, digital picture frames and other products” (FBI). Google’s January report found the same on “uncertified and off-brand Android Open Source Project devices, such as television set top boxes”.

4. A browser extension on your computer. The same trade exists on laptops: extensions that sell your spare bandwidth load other websites in hidden frames over your connection (how proxy SDKs and proxyware work).

Most of the documented cases are Android phones and Android-based boxes. HUMAN confirmed that the iPhone version of one of the 2024 apps “was not malicious”, and Honeygain has no iPhone app. That does not stop an iPhone from routing its own traffic through a VPN or a profile someone installed, which is what the settings above show.

The signs, according to the people who investigated

• Traffic you cannot explain. The FBI lists “Unexplained or suspicious Internet traffic” among its indicators, together with boxes sold as “unlocked or capable of accessing free content”, devices “from unrecognizable brands”, devices that require Google Play Protect “to be disabled”, and “Android devices that are not Play Protect certified” (FBI).
• CAPTCHAs and blocks. Trend Micro wrote that people who share their connection “might be asked to prove who they are or to get through more ‘validate you are a human’ tests” (Trend Micro), and Google that owners “can have their legitimate traffic flagged as suspicious, or blocked by their service providers” (Google Threat Intelligence Group, July 2026). If CAPTCHAs follow you around, see why websites think you are a bot.
• Data you did not use. Honeygain itself warns that on a capped plan “the data used could outweigh what you make” (Honeygain).

Each of these has ordinary explanations too: “An indicator alone does not accurately determine malicious cyber activity”, as the FBI puts it. Battery drain and heat get mentioned a lot online, but none of the investigations above lists them as a sign, so a warm phone proves nothing either way.

How to check your phone, step by step

1. Look at data use by app. On an iPhone: Settings, Cellular, then scroll to the list of apps and tap Show All; “The amount of cellular data used appears below each app” (Apple Support). On a Pixel: Settings, Network & internet, SIMs, App data usage (Pixel Help). An app you rarely open that uses a lot of data deserves a closer look.
2. Look at battery use by app, as a cross-check rather than proof: on an iPhone, Settings, Battery, View All Battery Usage (Apple Support); on a Pixel, Settings, Battery, Battery usage, View by apps (Pixel Help).
3. Read your app list for the giveaways: free VPNs you do not use, and apps that pay you for doing nothing. Google’s advice is blunt: “Consumers should be extremely wary of applications that offer payment in exchange for ‘unused bandwidth’ or ‘sharing your internet.’” (Google Threat Intelligence Group, January 2026).
4. Let Play Protect look. On Android, open the Play Store, tap your profile icon, then Play Protect. Play Protect can send you a notification, disable an app until you uninstall it, or remove it automatically (Google Play Help), and Google says it “automatically warns users and removes applications known to incorporate IPIDEA SDKs” on certified devices. To check that your phone or box is certified, open the Play Store, tap your profile icon, then Settings and About (Google Play Help).
5. Look beyond the phone. Your router’s app or admin page lists the devices on your Wi-Fi. A streaming box, projector or picture frame from a brand you do not recognise is the kind of device the FBI warns about.

How to stop it

• Uninstall the app. Google’s advice: “Uninstall any apps that you don’t need, don’t trust, or didn’t get from the Google Play Store.” (Google Account Help). Trend Micro advises removing proxyware from laptops, desktops and phones alike. Uninstalling a sharing app ends its sharing: Pawns.app’s terms say uninstalling “will automatically terminate all Traffic Sharing activities” (Pawns.app terms).
• Delete profiles you cannot explain on an iPhone, restart it, and reset its network settings if a VPN keeps coming back.
• Reset a phone only as the last step. On a Pixel, a factory reset “removes any issues from settings changes or third party software you didn’t want” (Pixel Help). Back up first.
• Unplug a suspicious box rather than reset it. The FBI’s advice is to “consider disconnecting suspicious devices from their networks”. HUMAN found the BADBOX 2.0 backdoor built so that it “couldn’t be removed”, and no source we found says a reset gets rid of it. Replace the box with a certified one: Google lists Android TV devices and devices certified for Google Play.
• Keep it from happening again. Install apps from official stores, keep Play Protect on, “avoid clones or ‘mods’ of popular apps” (HUMAN), and treat any app that pays for your connection as a proxy service, because it is one.

Is sharing your internet safe, or even allowed?

This is not legal advice, but the risks are on record. The traffic leaves from your address, so “it would be their IP address that got logged”, as Trend Micro put it of the people sharing (Trend Micro), and Google warns that through these networks “bad actors can access a user’s private devices on the same network” (Google Threat Intelligence Group, January 2026). Your internet contract may forbid it. Xfinity’s acceptable use policy forbids running equipment or servers that provide services “to anyone outside of your Premises local area network” and names “proxy services and servers” among its examples (Xfinity). The apps say so too: Honeygain notes that “Some ISPs restrict sharing or reselling bandwidth”, and EarnApp’s terms exclude anyone whose agreement with their internet provider prohibits such arrangements.

Check what websites see on your connection

If a proxy service is selling your address, the address may already be on the lists that websites check. The live check on Maskbreak’s homepage and the VPN checker run Maskbreak’s checks on your own visit and show whether your connection was flagged as a proxy, a VPN or Tor, with the service by name when it is known. Under the default policy of Maskbreak, the fraud detection API this blog belongs to, a visit from a known proxy exit is blocked, and that includes a home connection rented out as a residential proxy.

Read the answer with care. A clean result means this checker did not flag your connection at that moment, not that nothing on your network is sharing it. A flag does not prove an infection either: a mobile network may put many customers behind one address, and lists are built from past sightings. And an address typed into a lookup box cannot tell you this at all: Maskbreak’s lookup of an address checks only the Tor exit list and published cloud ranges.