A subscriber complains that their internet is slow, but your link to them is fine and nothing on your side changed. Very often the culprit is sitting in their living room: a generic Android TV box bought for IPTV. Many of these boxes ship with malware preinstalled at the factory. In June 2025 the FBI warned that the BADBOX 2.0 botnet had compromised more than a million such devices, turning them into residential proxies that criminals rent out for ad fraud, credential stuffing and other attacks. For the subscriber that means a box that eats upload bandwidth around the clock. For you it means support tickets that are not your fault, and your IP ranges showing up in abuse reports.
Look for the symptom: constant upload at odd hours
A TV box used for streaming mostly downloads. A box working as a proxy node uploads steadily, even at 4 a.m. when nobody is watching. Check the live traffic on the LAN (or subscriber-facing) interface:
/interface monitor-traffic bridge-lanIf tx on the LAN side (traffic going out to the internet from the clients) stays high with nobody using the connection, keep digging.
Find which device is generating it with Torch
/tool torch interface=bridge-lan src-address=0.0.0.0/0Torch breaks the traffic down by source address in real time. Sort by the tx column and note the IP at the top. If this MikroTik is the CPE at the subscriber's home, you will see the TV box directly. If it is your core router with PPPoE, you will see the subscriber first; repeat the step on their CPE to get to the device.
Identify the device behind that IP
/ip dhcp-server lease print where address=192.168.88.50
/ip arp print where address=192.168.88.50The lease usually shows a host name like android-3f2a… or the box model, and the MAC address tells you the manufacturer. Generic boxes (X96, H96, T95 and similar, usually with Amlogic or Rockchip chips) are the usual suspects.
Confirm with the connection count
/ip firewall connection print count-only where src-address~"192.168.88.50"A TV box that is only streaming keeps a handful of connections open. A proxy node keeps hundreds or thousands, to destinations all over the world. That pattern is the clearest sign you can get from the router alone.
Contain it while you fix the source
Put the device in an address list and cap its bandwidth so it stops hurting the rest of the network:
/ip firewall address-list add list=tvbox-quarantine address=192.168.88.50 comment="suspected BADBOX"
/queue simple add name=tvbox-quarantine target=192.168.88.50/32 max-limit=1M/8MThis is a patch, not a fix. The malware is still on the box, and it will keep trying. Blocking IPs or domains on the router becomes a race you lose, because the operators rotate their servers constantly.
Why do it this way
The router can show you where the traffic comes from, but it cannot remove what causes it. The malware lives in the box's system partition, signed as a system app, so the user cannot uninstall it from Android settings and a factory reset brings it back. The only lasting fix is to clean the device itself. That is why detection and eradication are two separate jobs: the network finds the infected box, and a tool running on the box removes the malware.
How MoniTik helps
MoniTik covers the network side. It graphs the traffic of every interface on each router, so a box uploading all night stands out, and it gives you remote WinBox to run Torch and the connection checks above without driving to the site, even when the router sits behind CGNAT or Starlink. For the cleanup, we built two sister products. If you provide IPTV with your own boxes, AdminSTB manages your whole fleet remotely and removes preinstalled malware without a technician visit. If the boxes belong to your subscribers, Android Malware Killer cleans them one at a time, and offers accounts for technicians and resellers.
Mateo supports wireless ISPs running MikroTik gear, from first install to day-two troubleshooting.