To stop crims, Google starts dismantling residential proxy network they use to hide

Google’s Threat Intelligence Group (GTIG) says it has significantly degraded IPIDEA, a large residential proxy network abused by more than 550 threat groups, by collaborating with Spur, Lumen’s Black Lotus Labs, and Cloudflare to disrupt infrastructure and domain resolution; the effort reduced millions of enrolled devices (smartphones, PCs, and other consumer hardware), which were often conscripted via proxy SDKs embedded in apps and in some cases also tied to botnets like BadBox 2.0, Aisuru, and Kimwolf—highlighting how residential proxies conceal malicious traffic and pose risks to users whose devices are repurposed for attacks.