Google Disrupts IPIDEA Residential Proxy Network Used by Hundreds of Threat Groups

Google and partners disrupted IPIDEA, described as one of the world’s largest residential proxy networks, which routed attacker traffic through millions of consumer devices acting as proxy “exit nodes.” Google Threat Intelligence Group (GTIG) reported that in a single seven-day period in January 2026, 550+ tracked threat groups used IPIDEA-linked IPs to obfuscate operations including access to victim SaaS environments, intrusion activity against on-premises infrastructure, and password-spray attacks; activity was attributed across multiple geographies including China, DPRK, Iran, and Russia. IPIDEA allegedly enrolled devices via SDKs embedded in mobile and desktop applications, including trojanized apps and “bandwidth monetization” lures, enabling the sale of residential IP space that can be abused for credential abuse, scraping, ad fraud, phishing, and C2 evasion.

The disruption effort included legal action and domain takedowns against infrastructure used to control devices and proxy traffic, with reporting indicating IPIDEA’s primary site became inaccessible and that the action degraded the available device pool by millions. Google also implemented ecosystem enforcement measures, including Google Play Protect blocking/removing apps containing IPIDEA SDK components, and shared intelligence intended to reduce re-enrollment and impact related proxy operators that rely on shared/resold device pools and rebranded services (e.g., 360 Proxy, Luna Proxy). Separate reporting tied abuse of residential proxy services like IPIDEA to botnet activity (e.g., AISURU/Kimwolf) and highlighted the user risk of having home networks unknowingly used for third-party traffic, increasing exposure to compromise and reputational harm.