SocksEscort sold proxy services on the open web, but was actually routing traffic through compromised routers from brands including TP-Link, Netgear and Cisco: https://www.pcmag.com/news/us-helps-shut-down-proxy-service-used-to-hack-thousands-of-routers