OkeyProxy
Member
Google Shuts Down Major Proxy Network
This week, Google and its partners disrupted one of the world’s largest residential proxy networks, known as IPIDEA. This network was secretly turning millions of people’s personal devices—like phones and computers—into hubs for cybercrime and espionage.
How It Worked
Residential proxy networks sell access to real home IP addresses, which criminals use to hide their location. To get these IPs, companies like IPIDEA pay app developers to hide special code (SDKs) inside seemingly normal apps and free VPNs. When you download one of these trojanized apps, your device is silently enrolled into the proxy network. Your internet connection is then sold to others, often without your knowledge.
The Harm Caused
While advertised as privacy tools, our research shows these proxies are overwhelmingly used for harm. In just one week, we saw over 550 hacking groups—including actors from China, North Korea, Iran, and Russia—using IPIDEA to hide attacks on businesses and governments. These attacks included breaking into email systems and corporate networks.
For the average person, having your device turned into an “exit node” is dangerous. It can slow down your internet, get your IP address flagged for fraud, and even let attackers access other devices on your home network.
A Web of Fake Brands
Our investigation found that IPIDEA operates behind many seemingly independent brand names, including:
• 360 Proxy, Luna Proxy, IP2World, 922Proxy.
• VPNs like Door VPN, Radish VPN, and Galleon VPN
They also control several SDKs (like PacketSDK and HexSDK) that are embedded into apps to secretly recruit devices.
What Google Did
We took legal action to shut down the domains used to control the network. We also ensured Google Play Protect automatically warns Android users and removes apps containing this malicious code. By working with partners like Cloudflare, we’ve disrupted their operations and reduced their pool of devices by millions.
How to Protect Yourself
• Be wary of apps or services that offer payment for “sharing your unused bandwidth.”
• Stick to official app stores and review app permissions carefully.
• Ensure security protections like Google Play Protect are active on your devices.
• Be cautious with low-cost or off-brand gadgets (like TV set-top boxes), which sometimes come pre-infected with this proxy software.
This industry thrives on deception, hijacking private bandwidth to enable global crime. While our action has made a significant impact, more needs to be done to hold these proxy providers accountable and protect users worldwide.
For more details, please read this article:
https://cloud.google.com/blog/topic.../disrupting-largest-residential-proxy-network
922proxy IPIDEA alternatives: https://momoproxy.com
This week, Google and its partners disrupted one of the world’s largest residential proxy networks, known as IPIDEA. This network was secretly turning millions of people’s personal devices—like phones and computers—into hubs for cybercrime and espionage.
How It Worked
Residential proxy networks sell access to real home IP addresses, which criminals use to hide their location. To get these IPs, companies like IPIDEA pay app developers to hide special code (SDKs) inside seemingly normal apps and free VPNs. When you download one of these trojanized apps, your device is silently enrolled into the proxy network. Your internet connection is then sold to others, often without your knowledge.
The Harm Caused
While advertised as privacy tools, our research shows these proxies are overwhelmingly used for harm. In just one week, we saw over 550 hacking groups—including actors from China, North Korea, Iran, and Russia—using IPIDEA to hide attacks on businesses and governments. These attacks included breaking into email systems and corporate networks.
For the average person, having your device turned into an “exit node” is dangerous. It can slow down your internet, get your IP address flagged for fraud, and even let attackers access other devices on your home network.
A Web of Fake Brands
Our investigation found that IPIDEA operates behind many seemingly independent brand names, including:
• 360 Proxy, Luna Proxy, IP2World, 922Proxy.
• VPNs like Door VPN, Radish VPN, and Galleon VPN
They also control several SDKs (like PacketSDK and HexSDK) that are embedded into apps to secretly recruit devices.
What Google Did
We took legal action to shut down the domains used to control the network. We also ensured Google Play Protect automatically warns Android users and removes apps containing this malicious code. By working with partners like Cloudflare, we’ve disrupted their operations and reduced their pool of devices by millions.
How to Protect Yourself
• Be wary of apps or services that offer payment for “sharing your unused bandwidth.”
• Stick to official app stores and review app permissions carefully.
• Ensure security protections like Google Play Protect are active on your devices.
• Be cautious with low-cost or off-brand gadgets (like TV set-top boxes), which sometimes come pre-infected with this proxy software.
This industry thrives on deception, hijacking private bandwidth to enable global crime. While our action has made a significant impact, more needs to be done to hold these proxy providers accountable and protect users worldwide.
For more details, please read this article:
https://cloud.google.com/blog/topic.../disrupting-largest-residential-proxy-network
922proxy IPIDEA alternatives: https://momoproxy.com