Google leads the dismantling of one of the world's largest residential proxy networks

At the end of January 2026, Google announced the disruption of one of the world's largest residential proxy networks. The operation, led by the Google Threat Intelligence Group, was publicly revealed in an official statement on the company's security blog after months of technical monitoring and intelligence gathering on the network's activity. The dismantled infrastructure operated on a global scale and used compromised devices to route internet traffic. The main objective was to curb the malicious use of millions of residential IP addresses that were being exploited to cover up illegal online activities.

At the heart of the incident lies the network known as IPIDEA, an infrastructure that turned domestic devices into exit nodes for third parties. These devices were integrated into the network through applications that incorporated proxy code. As a result, millions of people in different countries may have had their connections used for activities such as digital fraud, abusive automation of services, or masking cybercriminal operations. To counter the threat, Google obtained court orders to intervene in domains associated with control of the network, blocked malicious communications, and strengthened its detection systems on Android through Google Play Protect in order to identify and remove applications linked to this activity.

In its latest update, Google reported that the network's main infrastructure has been disrupted and its operational capacity significantly reduced. However, cybersecurity experts warn that these types of networks can be reconfigured under new structures or reappear with different names and distribution methods. Google has indicated that it will continue to collaborate with service providers, researchers, and international authorities to monitor possible reactivations and strengthen preventive protection.