Comcast Threat Research Lab Featured in The Wall Street Journal for Residential Proxy Research

Comcast is committed to helping make the internet safer by identifying emerging cyber threats before they can cause broader harm. That work is led in part by the Comcast Threat Research Lab (CTRL), a team that studies large-scale security data across Comcast's network to better understand how attackers operate and how cyber defenses can evolve.

CTRL's research into residential proxies, commonly called ResProxies, recently earned national attention from The Wall Street Journal. In a video feature, WSJ examined how millions of everyday internet-connected devices can be used to help conceal cyber activity. Karim Mahrous, Executive Director of the Comcast Threat Research Lab, served as a featured expert. Watch the full video below:

The Wall Street Journal also published a follow-up article highlighting Comcast researchers' discovery of ResProxy activity dating back to 2024. The article features expert commentary from Noopur Davis, Executive Vice President, Chief Information Security and Product Privacy Officer of Comcast. That can be read here.

What are ResProxies?

ResProxies are software applications that can run on phones, computers, smart TVs, routers, streaming devices, and other connected products. When installed, they can route someone else's internet traffic through that device's connection, making the activity appear as if it came from the device owner's home or business. In practice, that can allow cybercriminals and other bad actors to hide behind legitimate residential internet addresses while carrying out phishing, fraud, data theft, and other malicious activity.

By studying these threats at scale, CTRL is helping illuminate how ResProxy networks operate and how the broader security community can better detect and disrupt them.

Learn More

Comcast has published additional research on ResProxies and related cyber threats as part of its ongoing effort to share lessons learned and strengthen collective defense across the internet ecosystem. For more on Comcast's cybersecurity research and ResProxy findings, read:

• Lessons Learned, Lessons Shared

• Comcast's Proactive Cyber Defense Activities

• ResProxies - What Hasn't Been Herd Yet

• Localhost as an Attack Multiplier: ResProxy Co-Infection and Lateral Expansion

• Evolution of Jackskid Botnet: What We Found and How Residential Proxies Amplify Its Reach

• Unexpected GRE Decapsulation on Affected Arista Switches: How VXLAN Programming Created a DDoS Relay Risk