Authorities dismantle SocksEscort proxy network behind millions in fraud

Law enforcement led a multinational takedown of SocksEscort, a residential proxy service that infected home and small-business routers with malware to route traffic and sell anonymized access to criminals. Authorities seized 34 domains and 23 servers across seven countries, froze about $3.5M in cryptocurrency, and disconnected infected devices; the service had listed access to roughly 369,000 IP addresses and around 8,000 infected routers by February 2026, enabling large-scale fraud including multimillion-dollar losses.