Google Just Took Down One of the Biggest Residential Proxy Networks: The Story of 922 Proxy and PIA S5 in 2026
Google Just Took Down One of the Biggest Residential Proxy Networks
At the end of January 2026, a lot of people using cheap residential proxies ran into serious trouble. Clients stopped connecting, websites wouldn't load, dashboards became unreachable, and support either went quiet or gave generic replies.
The reason soon became clear: Google had hit IPIDEA, one of the largest residential proxy infrastructures in the world.
What Were 922 Proxy and PIA S5?
IPIDEA was a China-based operation that built a massive pool of real residential IPs by using regular people's devices. The method is well-known: users install apps or "free" VPN clients that contain their SDK. Without the owner realizing it, the device starts routing traffic and sharing its home IP as part of a big proxy network that gets rented out.
The twist? Dozens of seemingly independent services were actually running on the same backend. Google openly listed the main ones:
- 922 Proxy
- PIA S5 Proxy
- Luna Proxy
- 360 Proxy
- PY Proxy
- IP2World
- ABC Proxy
- Radish VPN
- Galleon VPN
- Tab Proxy
- and several more.
In practice, it was one large infrastructure marketed under different brand names.
How Google Detected and Disrupted the Network
On January 28, 2026, Google's Threat Intelligence Group published a detailed report. Their operation included:
- Court-ordered seizure of domains used to control devices and sell the service.
- Sharing technical details about the IPIDEA SDKs with platforms, researchers, and law enforcement.
- Updating Google Play Protect on Android to automatically detect and remove apps containing these SDKs.
- Working with Cloudflare and other partners to disrupt the network's command infrastructure.
Google says they removed millions of devices from the pool. The network took a heavy blow, though these things rarely disappear completely. They tend to reappear later in a new form.
Impact on Residential Proxy Users
In just one week in January, over 550 tracked threat groups were using IPIDEA exit nodes. This included actors linked to China, North Korea, Iran, and Russia. The proxies were used for account takeovers, password spraying, accessing corporate environments, and supporting botnets like BadBox 2.0, Aisuru, and Kimwolf.
Cheap residential proxies have become a go-to tool for anyone who needs to hide their real traffic source.
Echoes of 911 S5: A Familiar Pattern
Anyone who's been around for a while immediately thought of 911 S5. That service was shut down in 2022, and its operator was arrested in 2024. PIA S5 and 922 Proxy were often seen as its spiritual successors. The pattern looks familiar.
What This Means for Web Scraping in 2026
If you were using 922 Proxy, PIA S5, or any of the related services, it's probably time to look for alternatives. The market is already pushing new providers that claim to be cleaner and more transparent.
My personal takeaway: when proxies are unusually cheap and the providers stay vague about where the IPs actually come from, there's usually something shady going on. In 2026, that's clearer than ever.