Who is DSLRoot? A Deep Dive into the Residential Proxy Network

The cybersecurity community on Reddit responded in disbelief this month when a self-described Air National Guard member with top secret security clearance began questioning the arrangement they’d made with company called Dsloot which was paying $250 a month to plug a pair of laptops into the Redditor’s high-speed Internet connection in the United States. This post examines the history and provenance of dslroot, one of the oldest “residential proxy” networks with origins in Russia and eastern Europe.

The query about DSLRoot came from a reddit user “Sacapoopie,” who did not respond to questions. This user has as deleted the original question from their post, even though some of their replies to other Reddit cybersecurity enthusiasts blank” rel=”noopener”>here by archive.is and it began with a question:

“I have been getting paid 250$ a month by a residential IP network provider named DSL root to host devices in my home,” Sacapoopie wrote. “They are on a separate network than what we use for personal use. They have dedicated DSL connections (one per host) to the ISP that provides the DSL coverage. My family used Starlink. Is this stupid for me to do? They just sit there and I get paid for it. The company pays the internet bill too.”

Many Redditors said they assumed Sacapoopie’s post was a joke, and that nobody with a cybersecurity background and top-secret (TS/SCI) clearance would agree to let some shady residential proxy company introduce hardware into their network. Other readers pointed to a slew of posts from Sacapoopie in the Cybersecurity subreddit over the past two years about their work on cybersecurity for the Air National Guard.

when pressed for more details by fellow Redditors, Sacapoopie described the equipment supplied by DSLRoot as “just two laptops hardwired into a modem, which then goes to a dsl port in the wall.”

“When I open the computer, it looks like [they] have some sort of custom request that runs and spawns several cmd prompts,” the Redditor explained. “All I can infer from what I see in them is they are making connections.”

When asked how they became acquainted with DSLRoot, Sacapoopie told another user they discovered the company and reached out after viewing an advertisement on a social media platform.

“This was probably 5-6 years ago,” Sacapoopie wrote. “As then I just communicate with a technician from that company and I help trouble shoot connectivity issues when they arise.”

Reached for comment, DSLRoot said its brand has been unfairly maligned thanks to that Reddit discussion. The unsigned email

USProxyKing, BlackHatWorld, and a Network of Shady Services

USProxyKing cultivated a reputation on online forums for aggressively advertising his residential proxy service and operating a “pay-per-install” program. This program incentivized affiliates with commissions for each installation of his unspecified “adware” – likely software converting host PCs into proxies. Simultaneously, USProxyKing sold access to this installed base to those seeking to distribute dubious software, charging $1 per installation.

Further inquiry, including private messages indexed by intel 471, reveals USProxyKing solicited investments from nearly 20 BlackHatWorld members, promising them shareholder positions in a new robocalling venture capable of making 2,000 calls per minute.Constella Intelligence data links the IP address used by USProxyKing on BlackHatWorld to accounts on other sites, including WebHostingTalk, and the email address incorptoday@gmail.com. This email is also associated with domains like dslbay[.]com, dslhub[.]net, localsim[.]com, rdslpro[.]com, virtualcards[.]biz/cc, and virtualvisa[.]cc.

Notably, DSLRoot’s digitalpoint.com profile was previously named Incorptoday. DomainTools connects incorptoday@gmail.com to nearly two dozen domains dating back to 2008, including incorptoday[.]com, a business incorporation service offering packages from $450 to $550.

An archived version of the IncorpToday website from 2013 shows a $750 “premiere” service guaranteeing a retail checking account for the newly formed company,with minimal scrutiny.

Global Solutions leverages this network to facilitate access to the U.S. banking system, offering prepaid cards to its customers.

Legal Botnets

Many point fingers at military personnel who should know better than to install internet hardware from strangers. However, there’s a constant stream of U.S. residents willing to resell their internet connection for profit. Residential proxy providers now make this financially appealing.

historically, residential proxy networks relied on malware. This software secretly turned infected systems into traffic relays, then sold them on shadowy online forums. Often, this malware came bundled with cracked software and video files shared on file-sharing networks, silently converting host devices into relays. USPRoxyKing even boasted about achieving thousands of installs weekly through this method.

Today, several residential proxy networks actively encourage users to monetize their unused bandwidth – a practice that frequently enough violates their ISP’s terms of service. Others, like DSLRoot, function as communal VPNs. Using these services grants access to other proxies’ connections, but also requires sharing your own.

intel 471’s records show GlobalSolutions and DSLRoot accounts frequently received private messages from forum users, many of whom were college students or young people. A 2010 post on the Russian-language forum ulitka details a user struggling to obtain a B1/B2 visa to visit his brother in the U.S., despite prior approvals for guest and student visas. It’s unclear if the Holas brothers still reside in the United States; Andrei stated in 2010 that his brother was a U.S. citizen.