Google Disrupts Major Proxy Network Hijacking Millions of Devices

GTIG Takes Down IPIDEA Residential Proxy Network

Google Threat Intelligence Group (GTIG) and its partners said they disrupted IPIDEA, one of the world's largest proxy networks, last week. The Mountain View company said the operation successfully dismantled IPIDEA, which secretly turned Android devices and Windows PCs into Internet proxies for bad actors, allowing traffic to be routed via home networks to mask its origin.

In a blog post, GTIG detailed the disruption of the IPIDEA proxy network. An unauthorised service is referred to as a residential proxy network, where it uses devices to route Internet traffic in order to conceal the actual source of activity; rather than using commercial servers, IPIDEA connects consumers’ devices to create the impression that the link is originating from an actual residential IP address. Officials familiar with the matter said the IPIDEA network leveraged compromised devices to make connections appear to originate from legitimate home IP addresses.

GTIG described IPIDEA as a long running operation that hid in the shadows and used a large footprint of devices. The company said the takedown was announced in a blog post and represents a notable effort in disrupting illicit proxy networks. The post did not provide specific numbers on devices affected or traffic volume.

The disruption highlights Google\'s threat intelligence work in collaboration with partners to disrupt networks that enable cybercrime. Officials involved said the action demonstrates the impact that coordinated industry efforts can have on rapidly mutating proxy services.

Key details

• Network name IPIDEA
• Devices used Android devices and Windows PCs
• Purpose route traffic through home networks to mask origin
• Announcement made in GTIG blog post

The blog post outlines the disruption and the nature of IPIDEA, but does not provide additional operational details for security reasons. The company described IPIDEA as one of the most notable proxy networks operating in the shadows for some time. The takedown is described by GTIG as successful, though specific scale metrics were not disclosed in the post.