Google said in late January 2026 that it had pulled the rug out from under IPIDEA, one of the largest residential proxy networks in the world. Eight months later a threat-intelligence shop was counting the rug back on the floor. On September 4, Team Cymru Research published an intel brief saying the operators rebuilt from near zero starting in April and were near full operation by August. The firm said it was tracking 1,021,627 IP addresses tied to IPIDEA, and that the backconnect layer used to manage the nodes had climbed from the post-hit crater to 6,713 active tier-2 controllers, against about 7,400 before the disruption. Most of those controllers, the brief said, sat on Chinese hyperscale cloud in Singapore and Hong Kong. A takedown that does not stay down is not a failure of the press release. It is the business model.
The AEGIS Alliance is keeping that rebuild as the point, not the January victory lap. Residential proxies are other people’s phones, routers, television sticks, and set-top boxes rented out as exit nodes. The pitch to a device owner is a few dollars for unused bandwidth, or no pitch at all. The pitch to a buyer is a home internet address that will not trip the filters banks and social networks keep for data-center ranges. In one seven-day window in January, Google Threat Intelligence Group said more than 550 tracked threat groups used IPIDEA exits, including crews attributed to China, North Korea, Iran, and Russia. That number was never a club. It was a price list.
什么谷歌实际上关闭
一月的行动,在《宪法》中 谷歌贴文 时间越长 云相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相 相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相相, was legal and technical at once. GTIG and partners went after command domains, storefronts, and the software-development kits that enrolled devices, then sought court orders so the next landing page would have a name to serve. Play Protect was updated to warn Android users, strip apps known to carry the IPIDEA kit, and block new installs on certified devices. John Hultquist, GTIG’s chief analyst, said residential proxies had become a tool “for everything from high-end espionage to massive criminal schemes,” and that routing through a home connection let attackers “hide in plain sight.” 页:1 added the inventory: at least 13 residential-proxy brands went offline in the same action, with more than 600 Android applications and 3,075 unique Windows files tied to the command infrastructure. Google said the available pool dropped by millions of devices.
Some of those apps were sideloaded. Some rode in through software that promised a VPN, a cleaner phone, or a small monthly payment. IPIDEA had advertised itself as a leading proxy provider with millions of daily addresses. Google has also tied the network’s reputation to botnets including BADBOX 2.0, and in July 2025 it sued 25 unnamed defendants in China over that botnet and the proxy layer around it. The honest version of a bandwidth-sharing market exists. The version GTIG described treated consent as optional and the device as inventory. Once the kit is on the box, the owner is not a customer. The owner is a route. A researcher who tested endpoints before the hit, Antoine Vastel, reported more than 16 million unique addresses answering as part of the network in the prior 30 days. Millions removed is a real cost. It is not the same sentence as gone.
走廊有第二个门
On July 2, 2026, GTIG, the FBI, IRS Criminal Investigation, Lumen, and the Shadowserver Foundation moved on a different brand: NetNut, also tracked as Popa. Google’s follow-on post said the January lesson was that a single network can look resilient after a public hit, so the work had to be a program. In one week in June, GTIG said it saw 316 distinct threat clusters on suspected NetNut exits. The company estimated that network at roughly 2 million devices and said the new action cut the available pool by millions. The FBI and IRS seized public domains, including infrastructure used to supply static residential addresses through contracts with internet providers. Parent company Alarum told markets the outage could hit operations and results if it lasted. Buyers who had walked from IPIDEA to the next API found the next API in the same kind of trouble.
That is not the end of the supply. Team Cymru’s September count is the adult version of the January announcement. Proxy shops reconstitute on fresh controllers, often on cloud providers that will rent a virtual machine to a stranger. The brief’s sample of backconnect hosts already carrying open SOCKS proxies is the unglamorous part: an IP address in Singapore is not a moral category. It is a place a node can hide while a phone in another country does the exiting. Whitelabel brands that shared IPIDEA’s pool, names buyers knew as separate storefronts, were never separate networks. When the upstream was hit they blinked. When the upstream was rebuilt they had somewhere to point.
客厅的电视也是盘点的
电话是头条。 电视是比较安静的。 在2026年8月3日, ^ 技术循环 that Samsung would ban Smart TV apps that share a household’s internet connection with strangers, after researchers found residential-proxy kits inside popular titles, including games. A Samsung spokesperson said new registrations with that functionality were already restricted and that the company was removing apps that contained the components. LG had moved in the same direction after research suggested a large share of webOS apps were quietly sharing bandwidth. An app does not need to stay open to keep a tunnel. The set becomes an always-on exit. The owner sees a normal menu. The investigator sees a residential address and assumes a person.
That is the consumer version of the 550-group statistic. No one should sideload a “share your connection” app for a few dollars. Check what is installed. Revoke VPN and accessibility permissions a weather widget does not need. Factory-reset a cheap Android box that arrived with extra icons. If a relative was paid to run a bandwidth app, assume the box has been an exit and treat stored passwords as burned. Play Protect helps people who stay inside the official store. It does not help a television stick that never saw the store, and it does not help a Windows box that ran a cracked optimizer. The Windows file count in Google’s January inventory is the reminder that this was never only a phone story.
企业有不同的问题. 户外代理交通是账户收购 如何看起来像通勤客户。 仍视"家ISP"为"安全类"的欺诈团队正在购买代理店所销售的故事. AEGIS联盟 页:1 和 黑客新闻 文件会保留区分:家庭地址是路径,而不是身份。 该服务台的有关供应商风险案件包括: 信用额700 (英语). (英语. 暴露了近600万汽车购买者 国 务 院,则 幽灵猎人警告 说那些在银行里排水的船员 不同的产品。 家里的装置现在是陌生人的工作场所.
破坏是帐单,不是葬品
IPIDEA’s brands going dark was a real cost. Court-seized domains were a real cost. Millions of devices dropping out was a real cost. Team Cymru’s August snapshot says the operators paid the bill and reopened. NetNut’s July seizure says the FBI is willing to take the next storefront’s names. Samsung’s August policy says a television maker finally noticed that a game can be a tunnel. None of that retires the product. Bulletproof hosts used to sell the same invisibility with a server in a poorly supervised rack. Residential proxies sell it with a stranger’s living room. When one shop is hit, buyers walk down the hall. When the shop rebuilds on new cloud controllers, the hall gets its old tenant back under a fresh hostname.
Google framed both operations as a program, which is how a large vendor describes work that is public protection and market defense at the same time. Both can be true. A cleaner Android ecosystem is good for people who own phones. It is also good for the company that ships the operating system. Readers can hold those facts without doing the vendor’s publicity. The measurable test is the one Team Cymru already ran: how many addresses answer, where the controllers live, and whether the whitelabel brands are separate or just paint. “One of the world’s largest” was a January phrase. 1,021,627 tracked addresses in September is a count. The AEGIS Alliance will take the lawsuits as progress and the rebuild as the reason the lawsuits have to continue. The next app that offers to pay for idle bandwidth will use softer copy. The hallway will still be for rent, including to the fraud compounds and state crews that already know how to buy an exit by the hour, a market The AEGIS Alliance has traced through cases like the 没收比特币.
