Google and its partners have disrupted what they describe as one of the world’s largest residential proxy networks, IPIDEA, in a coordinated technical and legal operation targeting its sprawling infrastructure and affiliated brands.
The action was led by Google’s Threat Intelligence Group (GTIG), working with internal product security teams and external partners.
As part of the takedown, Google pursued legal measures to seize or sinkhole domains used as command‑and‑control (C2) for devices enrolled in the IPIDEA proxy network, cutting off operators’ ability to route traffic through compromised systems.
Google also shared detailed technical intelligence on IPIDEA’s software development kits (SDKs) and proxy components with platform providers, law enforcement, and research firms to drive broader ecosystem enforcement.
In response, Google has ensured that Google Play Protect automatically warns users, removes applications known to embed IPIDEA SDKs, and blocks future installation attempts of such apps on certified Android devices.
According to GTIG, the disruption has significantly degraded IPIDEA’s proxy network and business operations, shrinking its pool of available devices by millions.
IPIDEA’s Residential Network
Because residential proxy operators frequently share exit-node pools under reseller agreements, the impact is expected to cascade across related services and brands.
These SDKs, offered to developers across Android, Windows, iOS, WebOS, and other platforms, were surreptitiously enrolling user devices as exit nodes in the IPIDEA network.
Residential proxy networks sell the ability to route traffic through IP addresses assigned by ISPs to home and small business customers, allowing attackers to blend malicious traffic with legitimate consumer activity.
Operators obtain control of large numbers of IP addresses by embedding proxy code in trojanized apps, pre‑loading software on uncertified devices, or convincing users to “monetize” their bandwidth.
Once enrolled, a victim device’s IP and bandwidth are sold to paying customers, who can then abuse it for botnet control, credential attacks, or stealthy access to SaaS and on‑prem environments.
GTIG’s research links IPIDEA to multiple botnets, including BadBox 2.0, Aisuru, and Kimwolf, where its SDKs were used both to grow botnets and to provide proxy infrastructure for command-and-control.
In a single seven‑day window in January 2026, Google tracked more than 550 threat groups abusing IPIDEA exit nodes, including espionage and crime actors associated with China, DPRK, Iran, and Russia, to mask activities such as access to victim infrastructure and password spraying campaigns.
Implications
The investigation also ties IPIDEA to a web of seemingly independent proxy and VPN brands, including 360 Proxy, 922 Proxy, ABC Proxy, Cherry Proxy, Door VPN, Galleon VPN, IP2World, Luna Proxy, PIA S5 Proxy, PY Proxy, Radish VPN, and Tab Proxy.
Behind the scenes, these services share SDKs such as Castar SDK, Earn SDK, Hex SDK, and Packet SDK, all controlled by the same operators and backed by a typical two‑tier C2 architecture and a shared pool of roughly 7,400 Tier Two servers that dynamically scale with demand.
Distribution channels are broad and deceptive: GTIG has identified thousands of trojanized Windows binaries, Android apps embedding monetization SDKs, and “free VPN” offerings that quietly turn devices into exit nodes without clear disclosure.
Beyond enabling abuse, these proxy apps can expose users’ home networks by forwarding unsolicited traffic into local environments and even sending malicious payloads directly to devices.
Google’s latest action includes seizing marketing and SDK domains, coordinating with partners such as Spur, Lumen’s Black Lotus Labs, and Cloudflare to disrupt domain resolution and C2, and tightening enforcement against trojanized software across the Android ecosystem.
However, GTIG warns that the residential proxy market has evolved into a gray ecosystem built on opaque ownership, reseller layering, and deceptive consent practices.
Users are urged to avoid apps that offer money for “sharing bandwidth,” stick to official app stores, verify Play Protect status on Android devices, and favor reputable manufacturers for connected devices like set‑top boxes.
At the policy level, Google is calling for stronger accountability, insisting that claims of “ethical sourcing” of residential IPs be backed by auditable user consent, and urging platforms and ISPs to collaborate more closely to identify and dismantle illicit proxy networks.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
