Google Disrupts IPIDEA Residential Proxy Network Used for Cybercrime

Google’s Threat Intelligence Group (GTIG) and industry partners took coordinated legal and technical action to disrupt IPIDEA, described as one of the world’s largest residential proxy networks used to mask malicious activity behind legitimate household and small-business IP addresses. Google reported pursuing court action to seize/take down domains used to command infected devices and manage proxy traffic, while also sharing intelligence about IPIDEA software development kits (SDKs) with platform providers, law enforcement, and researchers to enable broader enforcement.

Google said the operation significantly degraded IPIDEA by reducing the available pool of proxy devices by millions, with impact likely extending to affiliated/resold proxy services that share infrastructure. On Android, Google expanded protections via Google Play Protect, including alerting users, removing apps known to include IPIDEA SDKs, and blocking future installation attempts on certified devices. Reporting linked IPIDEA SDKs to enrollment of devices into multiple botnets (including BadBox 2.0, Aisuru, and Kimwolf) and noted GTIG observed 550+ threat groups using IPIDEA exit nodes over a seven-day period in January 2026; affected devices reportedly spanned smartphones, Windows PCs, and other consumer hardware, with US/Canada/Europe residential IPs particularly sought after.