That afternoon, I stared at our company network logs
Last Wednesday at 4 p.m., I was checking my computer in a shared office in Hangzhou when I found an unfamiliar-device login alert in our company email. The device looked like it was on ordinary home broadband. It wasn't my phone or my partner's computer. My first reaction was not “check this right away.” I closed the alert page, worried that client data might already have been exposed. Later, I learned these alerts can be connected to residential proxies: ordinary home network devices used by someone else to conceal where a connection is coming from.
What it is, and why small teams should pay attention
Residential proxies aren't only “dangerous tools.” They're also used for cross-border e-commerce research, price comparisons, and compliance testing. The problem is that some proxy devices get quietly placed on company or home networks. Layer3 Intel reported finding signs of residential proxy traffic on networks related to the White House. My friend Lin Yue, an independent foreign-trade consultant in Xiamen, had a similar experience in March 2025: unfamiliar locations accessed the team's shared folder three nights in a row. Instead of trying to track down the attacker, she first froze the link permissions, exported the login records, and then changed each password. She handled it calmly, but before that, she was stuck wondering, “Which record should I check first?”
Reproducing the check today: free to start, 30 minutes for the basics
Money: $0 to start. I used the device records built into our router and cloud service dashboards before buying any software. Time: 30–60 minutes. Technical barrier: No coding required, but I needed to recognize my own phone, computer, and usual networks. First step: Log in to the company router's admin page, find “Connected Devices” or “Terminal Records,” then compare that list with login locations in the cloud drive and email account. If I couldn't find the entry point, I could reset the company network first, reconnect each device one by one, and turn on two-factor authentication.
The mistake I made was deleting records immediately. That erased the “who, when, and where” details. A steadier sequence is: take screenshots first, disable unfamiliar devices next, change passwords and enable two-factor authentication, then check whether file-sharing links allow access by strangers. Of course, not everyone needs this tool or process. If the company is just one personal computer with no shared client data, there's no rush to try it.
I’d stage this based on where the company is now
If I was just starting out and had no shared accounts, I'd begin with the three easiest steps: enable two-factor authentication for email, remove sharing links that strangers can access, and spend ten minutes reviewing login records once a month. With one or two clients already, I'd move client files into a separate workspace and set a weekly check of the device list and unusual logins. A basic inventory can be done without hiring a security consultant. As I was scaling and the team started sharing cloud drives and email accounts, I'd add a device list to the onboarding and handover process. Each teammate would register the devices they normally use; when someone left, I'd revoke their access at the same time and retain a copy of the anomaly logs. I'd rather ask one extra question now than wait for a client to spot the problem before we patch the hole.