You open the 922 S5 client, click “Connect,” and nothing happens. No spinning wheel, no authentication error. Just silence. You try the PIA S5 website, but it will not load. The same goes for ABCproxy. Your first—and perfectly reasonable—thought is that the server is down and will be fixed by morning. It happens. No big deal.
Except that is not what happened. These three services did not go down—they were taken down. All on the same day, along with another dozen lookalikes. Google and the FBI led the operation after discovering that these proxy services had effectively been one enormous botnet for years. If you ran traffic through them, this story directly affects you, even if you are no longer particularly worried about the balance you lost.
Let’s take it step by step: what happened, why the authorities had legal grounds to do it, where the entire scheme came from, and where to move so you do not make the same mistake again in six months. Because the chance that you will have to deal with this is never zero.
What Happened in January 2026
On January 28, 2026, Google Threat Intelligence Group and the FBI carried out an operation against a network called IPIDEA, describing it as one of the world’s largest residential proxy networks.
A residential proxy routes your traffic through someone else’s home internet connection. The system on the receiving end sees the IP address of an ordinary household rather than a machine in a data center. That is exactly why residential proxies are valued in affiliate marketing: to an anti-fraud system, the traffic looks like it is coming from a real person sitting at home on their couch.
The problem is that IPIDEA was not a single service. It was a shared backend powering around 13 different brands. Almost every name an affiliate marketer has encountered in industry chats was affected:
- 922 S5 Proxy (also known as 922proxy)
- PIA S5 Proxy
- ABCproxy
- LunaProxy
- PyProxy
- IP2World
- 360Proxy
- Cherry Proxy, Tab Proxy
- Related VPN brands, including Galleon, Radish, and Door
Different websites, different logos, and different prices—but the same engine under the hood. Google estimated that the operation removed around 9 million infected devices from the network and enabled the seizure of dozens of domains used to manage all that traffic. The websites and clients did not disappear one by one. They all died at once because the operation targeted their shared infrastructure rather than the individual services.
Why It Was a Botnet, Not a Proxy Service
Here is the key question: where does a service get millions of “residential” IP addresses?
A legitimate provider has a network of volunteers. A user installs a free or freemium app or extension on their phone, agrees to let their internet connection occasionally be used as an exit node—a point through which someone else’s traffic reaches the internet—and receives something in return: money, a premium subscription, or an ad-free experience. The user knows about it, provides consent, and receives compensation. That is why this model is called ethical sourcing.
IPIDEA operated differently. According to Google’s investigation, devices were added to the network through infected applications. Developers were offered ready-made SDKs—Castar SDK, Earn SDK, and others—and promised income from “traffic monetization.” Once a developer integrated the SDK, their users’ phones and computers quietly became the very “residential IPs” that other people later paid to use. The device owners knew nothing about it and had never given their consent.
| Put simply, when you paid 922 or PIA for residential traffic, you were renting access to other people’s compromised devices. It was not a volunteer’s home internet connection—it was a retiree’s tablet after they downloaded a free flashlight app. |
The company also found itself in very bad company. According to Google’s report, more than 550 tracked hacking groups used IPIDEA’s infrastructure within a single week, including state-sponsored APT groups and known botnets such as BADBOX 2.0. In other words, your campaigns were running through the same infrastructure as targeted cyberattacks.
To anti-fraud systems, this was not a “clean residential IP” but an address with an extremely questionable reputation. That, incidentally, explains why many media buyers saw conversion rates on these proxies decline over the last few months.
The Lineage: From 911 S5 to IPIDEA
If this all sounds familiar, you are not imagining it. IPIDEA is not the first—and unfortunately, is unlikely to be the last—name used for this kind of operation.
The original model was 911 S5, a service that had operated since 2014 and was once the best-known “residential” cesspit on the market. In 2022, its operator took it underground. In 2023, the network resurfaced as Cloud Router, and in May 2024, the FBI moved against it.
The result: the administrator, Chinese national YunHe Wang, was arrested, while investigators estimated that the network included 19 million compromised IP addresses worldwide. According to the charges, those addresses were used in fraudulent schemes worth billions of dollars. Fraudulent claims for COVID-19 relief benefits in the United States alone totaled $5.9 billion.
The model is simple and repeatable: build a botnet, sell access to it as “residential proxies,” operate for a couple of years, get caught in a law-enforcement operation, shut down, and reopen under a new name. 911 became Cloud Router. Fragments of that ecosystem grew into IPIDEA and its 13 brands. IPIDEA gets taken down today; tomorrow, something else appears with a new logo and “the best prices on the market.”
| Speaking of services “resurfacing,” websites such as 922proxy.app and 922proxy.org appeared immediately after 922 disappeared. They claimed to be the original service and invited users to “log in with your old email—we migrated the database.” Do not fall for it. These are clones exploiting the recognition of a dead brand. At best, they will trick you into making a deposit. At worst, they will collect your data or give you another infected client. The original service is dead, and it has no “mirrors.” |
What Happens to Your Money and Accounts Now
Bad news for anyone who still had money in their balance: it is most likely gone.
Judging by user reviews, the websites, apps, and personal accounts all stopped working after the shutdown. There is nowhere to request a refund and no one to request it from. A criminal network targeted by an FBI operation does not send out refund notifications.
What should you do? Accept the loss and write it off. Contacting the “support team” of a dead service is pointless.
But losing your balance is not the main risk. It is far more important to understand what you were doing through those proxies. Go through this short checklist:
- Do not look for “mirrors” or “alternative clients.” Any website claiming to offer a resurrected version of 922 or PIA is a trap. The same applies to Telegram channels offering “working builds,” as well as to any other service in a similar situation.
- Change any reused passwords. If you logged in to one of the dead services with an email address and password that you use elsewhere, change them. You handed those credentials to a company that was operating dishonestly by definition.
- Check what was running through those IPs. Accounts that you farmed or used to run traffic through IPIDEA’s residential network were tied to addresses with a poor reputation. If those accounts are being banned or placed on hold, that is not the platform being paranoid—it is a consequence of those IPs. Move valuable accounts to legitimate proxies before the platform makes the decision for you.
- Audit your campaign setups. Check where else these services are embedded in your infrastructure: API integrations, automated campaign launches, or third-party guides telling you to “get proxies from 922.” All of that is now dead code.
Where to Migrate: Legitimate Providers in 2026
I have two pieces of news for you:
- The good news: the residential proxy market does not end with IPIDEA, and you can realistically migrate within a day or two.
- The bad news—for your wallet: legitimate traffic costs more than stolen traffic. If you are used to getting “unlimited traffic for pennies,” prepare to pay by the gigabyte. At least you will not have to worry about your provider appearing in an FBI press release tomorrow.
In 2026, the market can be divided into roughly three tiers based on price and use case. The prices below are approximate as of July 2026. Rates change, so always check the current pricing before buying.
- Enterprise: maximum transparency and compliance. This tier is for buyers who need volume, stability, and a clean legal history. The leading providers are Bright Data and Oxylabs. Both have documented ethical sourcing, KYC procedures—Know Your Customer identity verification—and GDPR compliance. Prices are premium: residential traffic starts at several dollars per gigabyte and rises as requirements increase. This is not for small test campaigns. It is for those running serious, long-term operations who want to avoid unpleasant surprises.
- Mid-tier: a balance between price and quality. Decodo (formerly Smartproxy), SOAX, and DataImpulse charge around $3–6 per gigabyte and offer decent IP pools and responsive support. This tier is optimal for most solo media buyers and small teams: it is cheaper than enterprise services while still offering transparent sourcing and a solid reputation.
- Budget tier: when the cost of entry matters. IPRoyal, Webshare, and Evomi start at around $1.75 per gigabyte, while Evomi’s entry-level rate is approximately $0.49 per gigabyte. These are legitimate budget providers, not shady backroom operations. Still, the lower the price, the more closely you should examine where their IPs come from—more on that below.
A quick note on related proxy types to avoid confusion. Residential proxies are not the only option. There are also:
- Mobile proxies — traffic routed through real SIM cards and mobile operators. They are often even more reliable than residential proxies for account farming, but they cost more.
- ISP proxies, also known as static residential proxies — fast addresses registered to residential internet providers but hosted in data centers. They remain static rather than rotating.
The right option depends on your vertical and what the platform checks. The rule is simple: the stricter the offer’s anti-fraud system, the more “real” the IP needs to look.
How to Tell a Legitimate Proxy Provider From the Next Botnet
This is the most important section of the article because a brand name guarantees nothing.
Here is a recent example. On July 2, 2026, Google, the FBI, and Lumen took down another major residential proxy network—NetNut. This was separate from IPIDEA, but the underlying issue was the same: even a large, well-known brand can turn out to be a network built on compromised devices.
That is why you should choose a provider using a checklist, not a logo:
Run every provider—whether it is listed above or completely new—through these five questions:
- How do they explain the origin of their IPs? A legitimate provider clearly states that it uses an opt-in volunteer network or partner SDKs with explicit user consent. If the website offers nothing but vague claims about “millions of residential IPs worldwide” without explaining where they come from, that is a red flag.
- Do IP owners provide consent and receive compensation? The defining feature of an ethical network is that the person on the other end knows their connection is being used, has agreed to it, receives something in return, and can opt out with a single click. If the provider does not explain how peers give consent or what benefit they receive, the traffic is most likely stolen.
- Does the provider have KYC and a clear legal framework? Look for customer verification, a public acceptable-use policy, and GDPR compliance. A serious provider is not afraid to be transparent about these things. A company that lets anyone do anything without asking a single question is also serving the same people who will later destroy the reputation of its IP pool.
- What is the service’s history and reputation? How long has it been operating? Are there genuine independent reviews? Is there a real company behind it? A service that appeared six months ago with a perfect landing page and no traceable history is a risk.
- And the main test: the price. Here is a rule that will save you a lot of stress. If someone offers unlimited residential traffic at data-center proxy prices, without metering gigabytes and practically for free, that is not generosity. Legitimate residential traffic is expensive because it comes from real people who are compensated for providing it. “Unlimited residential traffic for a couple of dollars” almost always means the real cost is being paid through someone else’s compromised devices. That is exactly why IPIDEA was taken down.
If a provider comfortably passes the first four checks and does not try to look suspiciously cheap on the fifth, you can work with it. If it struggles with even a couple of them, keep looking—no matter how attractive the figures in its price list may be.
In Short
Cheap “residential proxies” did not disappear because you were unlucky with a particular service. They disappeared because cheap, unlimited residential traffic is almost always built on someone else’s compromised devices—and sooner or later, that kind of operation comes under the uncompromising hand of the law. 911 became Cloud Router, fragments of that network became IPIDEA, and NetNut went down next. The cycle repeats with remarkable consistency.
Those who moved to transparent providers long ago barely noticed what happened: they paid a little more per gigabyte and slept soundly. Those still searching for a “working 922 mirror” are simply preparing to lose money again.
Do not choose a provider by its logo or the prices in its rate card. Ask one question instead: where does this service get its IPs?
Good luck—and clean conversions!
FAQ
Not in their previous form. These were brands on a shared infrastructure that was seized by court order. Some brands might reappear under a new name someday, but it’ll be a different service and should be treated as a stranger. Sites now claiming to be the “resurrected 922” are clones.
Almost never. The user accounts and payment systems of these services are unavailable, and the network itself is under law enforcement operation. It’s smarter to write off the deposit as a loss and not waste time on “support.”
Free residential traffic almost always means you’re not the one paying — it’s people whose devices are used without their consent. “Free residentials” are at best bait, at worst an entry into another botnet. If a residential IP is free, someone else is the product.
The tool itself is legal: they’re used for ad verification, analytics, parsing. What’s illegal is a specific implementation — when IPs are sourced by infecting devices without the owners’ consent. So the question isn’t “proxy or not,” but “where does the provider get the addresses.”
Yes, reputable providers offer GEO selection, including Russia and CIS countries. The same rule applies: don’t just look for the right GEO, but check how the service explains the origin of those IPs.
Nothing from the IPIDEA list. It’s better to pause your campaigns for a day or two and switch to a transparent provider than to run valuable accounts through dead or cloned services and get banned.
Comments (0)