Guides

Is something selling your internet connection? How to find proxyware

Updated November 2, 2026 · 3 min read

"Proxyware" is software that sells your internet connection to other people. Companies pay you a little to run it, then rent your connection to their customers, who use your home internet address for their own traffic. Honeygain, Pawns, EarnApp, Peer2Profit, PacketStream, Repocket and Grass are well-known examples.

Installing one of these on purpose is your choice. The problem is that security researchers keep finding proxyware installed by malware and bundled downloads, without the owner's knowledge. Someone else collects the money, and you get the traffic.

Why it matters

• Strangers' traffic leaves from your address. Whatever they do online, from web scraping to ticket bots to fraud attempts, appears to come from your home.
• Your address gets a bad reputation. Websites start showing you constant "I'm not a robot" checks, streaming services block you, and banks may flag your logins as suspicious.
• It uses your bandwidth, which matters on capped or mobile connections.
• It is a sign of something else. Whatever installed it without asking may have installed other things.

Signs your connection is being resold

• CAPTCHA puzzles on almost every website, on every browser and device in the house.
• Network activity when nobody is using the internet: router lights flicker, or your internet provider's app shows heavy use at night.
• Sites telling you "unusual traffic from your network".
• Your internet address showing up on blocklists (search "is my IP blacklisted" from home and use a blocklist checker).

How to find it on Windows

1. Installed apps. Settings > Apps > Installed apps (on Windows 10, Apps & features). Search for the names above, and for anything describing itself as "earn passive income", "share bandwidth" or "network node".
2. Services. Press Windows + R, type services.msc. Proxyware often installs a service so it runs before anyone signs in.
3. Startup apps. Task Manager (Ctrl + Shift + Esc) > Startup apps.
4. Network use. In Task Manager's Processes page, click the Network column to sort. A background program steadily sending and receiving data while you do nothing is the giveaway. Resource Monitor's Network tab (type resmon in Start) shows exactly which program and how much.
5. Browser extensions. Some proxyware comes as a browser extension. Check your extensions page in each browser.

Check every computer in the house. Proxyware runs on Macs and Android phones too, and cheap off-brand Android TV boxes have been caught arriving with software that quietly does the same thing.

How to remove it

1. Uninstall it from Installed apps. If it will not uninstall, stop and disable its service first (services.msc, set Startup type to Disabled, click Stop), then try again.
2. Disable its startup entry and remove any browser extension.
3. Restart and watch the Network column again for a few minutes.
4. If you did not install it, find out what did: look at what else was installed on the same date, and run a full scan.
5. Restart your router. Some internet providers then give you a new address, which leaves the bad reputation behind; if yours does not, the reputation fades once the traffic stops.