Google on Wednesday reported actions to disrupt domains linked to IPIDEA, a large residential proxy network, with the stated aim of protecting millions of consumer devices from misuse by cybercriminals and state-sponsored actors. Residential proxy services route internet traffic through compromised consumer IP addresses, enabling malicious traffic to blend with legitimate user activity and evade some security controls.
The effort was led by the Google Threat Intelligence Group (GTIG). According to Google, the operation combined legal measures to seize domains used to control compromised endpoints with automatic protections for Android devices implemented through Google Play Protect. The company said these steps have "caused significant degradation of IPIDEA's proxy network and business operations, reducing the available pool of devices for the proxy operators by millions."
Google reported that IPIDEA ran at least 13 residential proxy brands and that those brands were taken offline as part of the disruption. The investigation identified more than 600 Android applications associated with the network's command-and-control infrastructure and 3,075 unique Windows files tied to the same infrastructure, according to Google's account.
Residential proxy networks operate by routing traffic through consumer devices whose IP addresses have been hijacked. By sending malicious traffic through these devices, operators make it harder for defenders to distinguish harmful activity from legitimate user behavior. The Google disclosure emphasized both the scale of the operation they targeted and the technical steps taken to reduce the network's ability to recruit and control devices.
The company's combined approach of legal domain seizures and platform-level protections for Android users represents a dual legal-technical strategy aimed at interrupting command-and-control channels and preventing further device compromise. Google characterized the outcome as a meaningful reduction in the number of devices available to the proxy operators.
Details provided by Google included the count of connected software artifacts and the number of proxy brands taken offline, but the company did not provide a precise final tally of devices removed from the network. The disclosures highlight the continued use of both mobile applications and Windows-based files in sustaining residential proxy infrastructures.
Sectors mentioned or affected: cybersecurity, consumer devices, mobile operating systems, desktop operating systems, and internet infrastructure.