Cheap H96 streaming sticks moonlight as ad-fraud bots and residential proxies

Bitsight researcher Pedro Falé cracked open a sprawling ad-fraud operation after registering an expired telemetry domain that tens of thousands of H96 Android TV boxes were still phoning home to. The data revealed the devices were impersonating mobile phones from Samsung, Vivo, Huawei, and Xiaomi, all running two identical apps traced to Zhejiang Fengwo IoT Technology, a mainland China firm operating behind a web of Hong Kong and Singapore shell identities. The spoofed devices click ads on Fengwo’s own AI-generated content sites—fake finance, health, and gaming blogs that serve ads only to visitors matching the boxes’ faked phone profiles.

The operation is engineered for scale and deniability. Fengwo builds its sham sites and fraud routines using a repurposed version of Blockly, Google’s drag-and-drop coding tool for children, letting low-skilled operators assemble ad-click scripts without understanding the underlying code. Modules pushed to a targeted box can silently open a browser, navigate pages, and identify and click ads using a fused computer-vision and reasoning system that mimics human behavior. Notably, the boxes never run proxy traffic and ad fraud simultaneously: when an HDMI signal indicates the TV is on, the device acts as a residential proxy; when the TV is off, it switches to ad-fraud jobs, since fraud is too resource-heavy to run during streaming.

Bitsight tracked roughly 38,000 boxes reporting to a single older Fengwo domain, conservatively estimating ad-fraud revenue near $50,000 a day on top of separate proxy income. The findings underscore a persistent problem: despite repeated FBI and industry warnings, Amazon, Best Buy, Newegg, and others still sell hundreds of these insecure, authentication-free boxes bundled with pre-installed residential proxy software—devices that a Synthient report found botnets had already enslaved by the millions. Fengwo’s public claim of renting out 120,000 ‘AI digital humans’ is likely marketing cover for the operation rather than a real product line.