I think it's because they're making money by selling access to your residential IP to people overseas to circumvent geo-blocking. And that's if you're lucky -- probably the expectation should be they're installing malware.