Skip to content
CrawlfolioSourced research on web data for AI
Menu

Dataset

Residential proxy takedowns tracker

A dated log of 18 law-enforcement, court and platform actions against residential proxy networks, the botnets and the SDKs that fed them, 2021–2026.

Updated

Rows
18
Verified
to

License: CC BY 4.0. Status: Historical action log, reviewed on 2026-11-12: one action added (XCPE) and nine existing rows re-read against their sources that day. Rows whose source I could not re-read keep their earlier verification date. This is not current service availability or a complete criminal-case tracker..

Download CSV

Residential proxy takedowns trackerVerified to
Network or targetDate of actionActionWho actedJurisdictionHow the IPs were allegedly obtainedScale (as stated by the source)Brands named by the sourceStatusVerifiedSource
Glupteba7 Dec 2021Civil lawsuit plus disruption of command-and-control serversGoogleUS (S.D.N.Y., civil)Malware on Windows computers; Google says the botnet was "setting up proxies to funnel other people's internet traffic through infected machines"About 1 million compromised Windows devices worldwide (Google)Not applicableGoogle announced a civil action against Glupteba operators and a technical disruption of C2 infrastructure.Google: New action to combat cyber crime
RSOCKS16 Jun 2022Infrastructure disruption (court-authorized)US DOJ, FBI; police in Germany, the Netherlands and the UKUS (S.D. Cal.), Germany, Netherlands, UKMalware on computers, phones and IoT devices; sold as a proxy service while routing traffic through hacked devices (DOJ)DOJ described millions of hacked devices worldwide; its initial 2017 undercover purchase identified about 325,000 victim devices.RSOCKSDOJ announced disruption of the infrastructure on 16 June 2022; later plea or case disposition was not reverified.DOJ (S.D. Cal.): Russian botnet disrupted in international cyber operation
IPStorm14 Nov 2023Guilty plea plus dismantling of the botnet and proxy infrastructureFBI (San Juan), US DOJ; Spanish National Police; Dominican National PoliceUS (D. Puerto Rico), Spain, Dominican RepublicMalware on Windows, Linux, Mac and Android devices, turned into proxies for sale (DOJ)DOJ said the operator advertised over 23,000 proxies and acknowledged at least $550,000 in proceeds.proxx.io and proxx.net (DOJ)Dismantled; operator pleaded guilty on 2023-09-18 to three counts of damaging protected computersDOJ (D.P.R.): Russian and Moldovan national pleads guilty to operating illegal botnet proxy service
PROXYLIB / LumiApps SDK26 Mar 2024App removal and Play Protect detection (platform action)Google (Google Play), after research by HUMAN's Satori teamPlatform action (Google Play, worldwide)Free VPN and other Android apps carrying a library or SDK that made the phone a proxy node without the user's awareness (HUMAN)HUMAN reported 28 identified applications removed from Google Play; the majority of its first-variant apps posed as free VPNs.LumiApps SDK; HUMAN reported traffic experiments and registration evidence connecting the network to Asocks. This is attributed research, not a court finding.HUMAN reported 28 removals and Play Protect detection/blocking; its report said LumiApps continued operating at that time.HUMAN Satori actual PROXYLIB/LumiApps report, 26 March 2024
911 S529 May 2024Arrest, indictment, domain and server seizures; US sanctionsUS DOJ, FBI; US Treasury (OFAC); Singapore authorities (arrest)US; arrest in SingaporeMalware spread through free VPN apps and pirated software on Windows computers (DOJ; Treasury names MaskVPN and DewVPN)DOJ alleged more than 19 million unique IP addresses, including 613,841 in the US, and about $99 million received from proxy sales during 2018–July 2022.911 S5; MaskVPN and DewVPN apps (Treasury)Dismantled; alleged administrator YunHe Wang arrested 2024-05-24 and charged; Treasury sanctioned him, two associates and three Thai companies on 2024-05-28DOJ: 911 S5 Botnet Dismantled and Its Administrator Arrested in Coordinated International Operation
NSOCKS / ngioweb19 Nov 2024Network null-routing of botnet infrastructure (private-sector action)Lumen Black Lotus Labs; Shadowserver Foundation (sinkholing); SpurPlatform action (Lumen's global network)The ngioweb malware on home and small-office routers and IoT devices (Lumen)About 35,000 bots a day across 180 countries; at least 80% of NSOCKS bots came from ngioweb (Lumen)NSOCKS; Lumen says all Shopsocks5 proxies it found were also available in NSOCKSLumen said it blocked traffic to/from dedicated ngioweb infrastructure across its own global network; Shadowserver was sinkholing some of the known DGA domains.Lumen Black Lotus Labs: the use and abuse of the NSOCKS botnet
BadBox (Germany sinkhole)12 Dec 2024Sinkholing of command-and-control trafficGermany's Federal Office for Information Security (BSI), with German internet providersGermany (BSI Act § 7c)Malware pre-installed on cheap Android devices such as digital picture frames and media players (BSI)Up to 30,000 devices in Germany (BSI)Not applicableC2 communication redirected to a sinkhole for affected devices in GermanyBSI press release: BSI weist auf vorinstallierte Schadsoftware auf IoT-Geräten hin
Anyproxy / 5socks (Operation Moonlander)9 May 2025Indictment and domain seizureUS DOJ, FBI (Oklahoma City); Dutch National Police and Public Prosecution Service; Royal Thai Police; Lumen Black Lotus LabsUS (N.D. Okla.), Netherlands, ThailandDOJ alleged malware on older wireless routers installed without owners' knowledge and sold as proxy access.DOJ said 5socks advertised over 7,000 proxies and the defendants were believed to have amassed over $46 million.Anyproxy.net and 5socks.net (DOJ)Domains seized; three Russian nationals and one Kazakhstani national chargedDOJ (N.D. Okla.) press release on the Anyproxy and 5socks botnet
BadBox 2.017 Jul 2025Civil lawsuitGoogle (coordinating with the FBI)US (federal court in New York, civil)Malware pre-installed on uncertified Android TV boxes and similar devices, or delivered through apps from unofficial stores (Google; FBI)More than 10 million uncertified Android devices (Google)Not applicableGoogle announced it had filed a New York federal lawsuit and updated Play Protect to block BadBox-associated apps; outcome not verified.Google: We're taking legal action against the BadBox 2.0 botnet
IPIDEA29 Jan 2026Legal action to take down domains, DNS disruption, Play Protect enforcementGoogle Threat Intelligence Group; Cloudflare; Spur; Lumen Black Lotus LabsLegal action (court not named by Google); platform actionSDKs embedded in apps, VPN apps with hidden proxy code, and trojanized software (Google)Device pool reduced "by millions"; over 550 threat groups used IPIDEA exit nodes in one week of January 2026 (Google)Google lists 360 Proxy, 922 Proxy, ABC Proxy, Cherry Proxy, Door VPN, Galleon VPN, IP 2 World, Ipidea, Luna Proxy, PIA S5 Proxy, PY Proxy, Radish VPN and Tab Proxy, and the Castar, Earn, Hex and Packet SDKsControl and marketing domains taken down; Play Protect warns about and removes apps with IPIDEA SDKsGoogle Threat Intelligence Group: Disrupting the largest residential proxy network
SocksEscort11 Mar 2026Domain and server seizures (Operation Lightning)US DOJ, FBI; Europol and Eurojust; police in Austria, France and the Netherlands; Lumen Black Lotus Labs; ShadowserverUS (E.D. Cal.), Netherlands, France, Austria; EU coordinationDOJ reported malware on home and small-business routers sold as proxy access.DOJ reports about 369,000 distinct IP addresses offered since summer 2020; in February 2026 about 8,000 infected routers were listed, including 2,500 in the US.SocksEscortService taken offline; no arrests announced (Dutch police)DOJ (E.D. Cal.): Authorities dismantle global malicious proxy service that deployed malware
Aisuru, KimWolf, JackSkid and Mossad botnets19 Mar 2026Court-authorized seizure of command-and-control infrastructure; later arrestUS DOJ, FBI, Defense Criminal Investigative Service; authorities in Canada and Germany; more than 20 companies (CyberScoop)US (D. Alaska), Canada, GermanyMalware on IoT devices (DVRs, cameras, routers, Android TV boxes); KimWolf spread by abusing residential proxy networks to reach devices on home networks (CyberScoop, BleepingComputer)More than 3 million hijacked devices across the four botnets (DOJ)Not applicableDOJ announced C2 disruption on 19 March. Its 21 May announcement says an alleged KimWolf operator was arrested in Ottawa on 20 May after an April US criminal charge; not a conviction.DOJ (D. Alaska): Authorities disrupt world's largest IoT DDoS botnets
Unnamed 17-million-device proxy botnet (Netherlands)28 May 2026Server seizure; botnet taken offlineDutch National Police (The Hague cybercrime team); National Cyber Security Centre (NCSC-NL); a hosting providerNetherlandsMalware on computers, tablets, smartphones, routers and IoT devices (Dutch police)At least 17 million infected devices; about 200 servers in the Netherlands (Dutch police)Not applicableSeveral servers seized for investigation; the hosting provider took the botnet offline; no arrests announcedPolitie: Politie en NCSC halen groot botnetwerk offline
NetNut (per Google, "also known as Popa")2 Jul 2026Domain seizures; platform disruptionFBI (seizures; the seizure notice also cites IRS Criminal Investigation, per KrebsOnSecurity); Google Threat Intelligence Group; Lumen Black Lotus Labs; Shadowserver FoundationUSSDKs distributed for home devices such as smart TVs and streaming boxes (Google)At least 2 million devices (Google estimate); 316 threat clusters used suspected NetNut exit nodes in one week of June 2026 (Google)NetNut, which Google calls also known as Popa. In its July 3, 2026 release, furnished to the SEC July 6, parent Alarum said the FBI had seized certain associated domains and then additional domains. This is a dated company acknowledgment, not a judicial finding about every NetNut service.Alarum announced a temporary pause of relevant network traffic in July 2026; its July 13 update said root cause remained unknown and recovery alternatives were being evaluated. An August 27 SEC report delayed financial results due to ongoing developments. Alarum's annual-meeting proxy statement dated November 5, 2026 says its audit committee is overseeing matters relating to previously disclosed seizures of certain NetNut Ltd. domains, which it attributes to the U.S. Department of Justice. The netnut.io domain still showed a "Seized by the Federal Bureau of Investigation" banner on 2026-11-12. Current service availability, criminal charges and case outcome were not independently verified.Google Threat Intelligence Group: Google's Continued Disruption of Malicious Residential Proxy Networks
Residential proxy SDKs in LG webOS apps21 Jul 2026Platform policy: apps must remove proxy SDKs or be suspendedLG ElectronicsPlatform action (LG webOS app store)Residential proxy SDKs bundled in smart-TV apps (Spur research, via KrebsOnSecurity)Krebs reported Spur found residential proxy SDKs in more than 42% of apps available on LG webOS; this is a dated research finding.Not applicableLG says it is working with developers to remove the proxy option; apps that keep it "will be suspended"KrebsOnSecurity: LG to Ban Residential Proxies from Smart TV Apps
Residential proxy SDKs in Samsung Tizen apps3 Aug 2026Platform policy: ban on residential proxy SDKsSamsungPlatform action (Samsung Tizen app store)Residential proxy SDKs bundled in smart-TV apps (Spur research, via KrebsOnSecurity)Spur found similar components in more than a quarter of Samsung Tizen apps (via KrebsOnSecurity, 2026-07-21)Not applicableSamsung told TechCrunch it had already restricted new app registrations with proxy functions and was working to identify/remove existing apps with the components.TechCrunch: Samsung bans smart TV apps that share users' internet connections with strangers
QTRouter and QScan (QTFY)26 Aug 2026Court-authorized domain seizureUS DOJ, FBI; Lumen Black Lotus Labs (tracking)USDOJ says QTRouter combined IoT devices compromised by QScan, commercial proxy-service devices and leased virtual private servers.Not applicableNot applicableDOJ said the domain seizures made QScan and QTRouter inoperable on 26 August 2026; later availability was not tested.DOJ: Justice Department and FBI Seize Platforms Operated and Used by China State-Sponsored Hackers to Target U.S. Critical Infrastructure
XCPE (x.cpe) backdoor and botnet3 Nov 2026Legal action to take down command-and-control domains and servers; ban from certified Android devices (platform action)Google Threat Intelligence Group, with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAILegal action (court not named by Google); platform actionA backdoor built into the firmware of Android TV set-top boxes and other Android IoT devices, which loaded modules that turned devices into residential proxy exit nodes "without users' knowledge or consent". Google assesses with high confidence that the manufacturer Videostrong Technology Co. developed and operated it (Google)More than 1.3 million set-top boxes enrolled; Google expects the disruption to sever access to at least 10 million additional compromised devices (Google)Google lists residential proxy modules loaded via the backdoor: Linkfog; the AppSalt SDK, which Google says is owned by Honeygain, in turn owned by Oxylabs; IPWeb/Bestipip; GaGaNode, which Google calls IPCola's SDK; NetNut's Popanet SDK; Traffmonetizer; and EarnFM's Fleet SDK. Google attributes the operation to Videostrong and does not say these companies knew of or took part in it.Google announced legal action against the domains and servers Videostrong used, and against C2 domains of over a dozen malware families loaded through the backdoor; it banned Videostrong and future affiliates from building or supplying certified Android devices.Google Threat Intelligence Group: Shutting the door on the XCPE botnet
  • Glupteba: Date is Google's 7 December 2021 announcement, not a freshly verified complaint filing date; the post says the suit was filed in the Southern District of New York. Google explicitly warned the blockchain-based botnet could recover. Unverified named proxy-rental sites and defendant counts were withdrawn in the targeted 16 October 2026 review; subsequent litigation is outside this row. Source re-read 2026-11-12.
  • RSOCKS: DOJ's actual article supports the historical $30/day for 2,000 and $200/day for 90,000 advertised proxy bundles. A claimed later guilty plea is withheld because this announcement does not establish it; targeted 2026-10-16 check.
  • IPStorm: Announcement date is 14 November 2023; the guilty plea was 18 September. DOJ limits the dismantlement to the defendant infrastructure, not remediation or deletion of all victims' information. The article describes deployment from at least June 2019 through December 2022; targeted 2026-10-16 source check.
  • PROXYLIB / LumiApps SDK: Date is HUMAN's report date. Primary report replaces the blocked news link in the targeted 2026-10-16 review. The unconfirmed count of 17 VPN apps and February removal timing are withheld; this is not a current app-store audit.
  • 911 S5: DOJ announcement 29 May 2024 reports arrest on 24 May, sanctions on 28 May, and seizure of 23 domains and more than 70 servers. These are historical announcement/indictment allegations, not a verified later conviction; targeted 2026-10-16 check.
  • NSOCKS / ngioweb: Historical 19 November 2024 report, not a worldwide law-enforcement shutdown. Lumen's words are that it blocked all traffic across its global network to or from the dedicated ngioweb infrastructure; Shadowserver was sinkholing some of the known DGA domains, not all. The previously stated July 2026 C2 rebuild is withdrawn because the cited page does not establish that later event. Source re-read 2026-11-12.
  • BadBox (Germany sinkhole): Date is the BSI announcement. BSI says BadBox can act as a residential proxy, handing the owner's connection to unknown third parties for crimes. Source re-read 2026-11-12.
  • Anyproxy / 5socks (Operation Moonlander): DOJ announcement 9 May 2025 reports domain seizures and four indictments, which are allegations. The updated article adds a 23 July victim-notification order and remediation of 547 US devices; no later criminal outcome inferred. The separate malware-family attribution was not reverified.
  • BadBox 2.0: Date is the Google announcement (17 July 2025), not the unverified 11 July filing date. Unverified defendant count and additional FBI-alert details were withheld; Google attributes the >10 million figure to uncertified devices running Android open-source software. Source re-read 2026-11-12; it shows no update note.
  • IPIDEA: Date is Google's publication. Google's "by millions" is its own assessment, not a measured count. Source re-read 2026-11-12; it shows no update note. Whether any brand domains came back later was not verified.
  • SocksEscort: Action occurred 11 March, confirmed by DOJ's 12 March article and Dutch police's 12 March announcement. Dutch police said no arrests were made in that operation. Counts of 34 domains, 23 servers, $3.5 million frozen and the AVrecon family label were not established in the two primary pages read and remain withheld pending the underlying source. Dutch source: https://www.politie.nl/nieuws/2026/maart/12/10-internationaal-succes-tegen-georganiseerde-cybercrime-criminele-proxydienst-uit-de-lucht.html
  • Aisuru, KimWolf, JackSkid and Mossad botnets: Primarily a DDoS operation. Google's 29 January IPIDEA report connects residential-proxy SDK infrastructure with Aisuru and KimWolf; that does not make every infected device a proxy exit. Later arrest source read 16 October: https://www.justice.gov/usao-ak/pr/canadian-man-arrested-international-authorities-charged-administrating-kimwolf-ddos
  • Unnamed 17-million-device proxy botnet (Netherlands): Dutch police announcement 28 May 2026, updated 29 May, names no proxy vendor. It states at least 17 million infected devices and 200 hosting servers in the Netherlands; several servers were seized and the provider took the botnet offline. It does not prove no later arrests or the current service state. Source re-read 2026-11-12.
  • NetNut (per Google, "also known as Popa"): Row date is the seizure day (2 July, per KrebsOnSecurity and Alarum's July 2 statement); Google's report is dated 3 July. Google's report is the source for the device and threat-cluster estimates and describes Google's own actions in coordination with the FBI and Lumen; the seizure itself and Shadowserver's role come from the seizure notice as reported by KrebsOnSecurity (https://krebsonsecurity.com/2026/07/fbi-seizes-netnut-proxy-platform-popa-botnet/). Re-read 2026-11-12: Google's report, the Krebs article, Alarum's July 3 statement (https://www.sec.gov/Archives/edgar/data/1725332/000121390026075179/ea029704201ex99-1.htm), the pause exhibit headed July 4 with a July 6 body dateline (https://www.sec.gov/Archives/edgar/data/1725332/000121390026075170/ea029706002ex99-3.htm), the July 13 update (https://www.sec.gov/Archives/edgar/data/1725332/000121390026077383/ea029779901ex99-1.htm), the August 27 report (https://www.sec.gov/Archives/edgar/data/1725332/000121390026094126/ea0303595-6k_alarum.htm) and the November 5 proxy statement (https://www.sec.gov/Archives/edgar/data/1725332/000121390026117242/ea031144501ex99-2.htm). The July 22 and August 13 litigation disclosures were last read 2026-10-16: shareholder discovery/class-certification motions and a US complaint are company-reported, not certified classes, criminal charges or findings of liability. No current-availability or absence-of-charges inference.
  • Residential proxy SDKs in LG webOS apps: LG's statement was supplied to Krebs, not independently read in a public LG policy. It describes removing residential-proxy functionality generally and says noncompliant apps will be suspended; LG called its review "well underway", but no completion date or enforcement outcome is proven. Source re-read 2026-11-12; its only update (22 July) adds a vendor statement.
  • Residential proxy SDKs in Samsung Tizen apps: Samsung's statement was supplied to TechCrunch, not independently read in a public Samsung policy. Its wording covers residential-proxy functionality generally; no completion date or current app-store sweep is proven. The comparative app percentage is Spur research as reported by Krebs, not a fresh census. TechCrunch also reports Samsung saying it is implementing platform-wide developer policies that ban residential proxy SDKs. Both sources re-read 2026-11-12.
  • QTRouter and QScan (QTFY): DOJ attributes the platforms to QTFY and Nanjing Xinjiuwei. Its actual article resolves the supposed sourcing conflict: the network mixed compromised devices, commercial proxy access and leased servers. The three-domain count/names are withheld because that detail was not verified in the article text; targeted 16 October 2026 check.
  • XCPE (x.cpe) backdoor and botnet: Date is Google's publication date shown on the page (3 November 2026); some news reports date the announcement 2 November. Google names no court. Videostrong's attribution is Google's assessment, not a court finding; The Record reported that Videostrong did not respond to requests for comment (https://therecord.media/google-dismantles-botnet-hidden-android-tv-boxes). Google says the Popanet C2 infrastructure was already taken down in its earlier NetNut disruption. Whether every C2 domain stays down was not verified.

Download CSV (CC BY 4.0). Scroll sideways for more columns.

How this data was collected

What counts: an official action against a residential or mobile proxy network, or against the botnet, malware or SDK that supplied its IP addresses. That means an arrest, indictment, court-authorized domain or server seizure, sinkholing by a national agency, sanctions, a civil lawsuit, or a platform action by a major company (Google, Lumen, LG, Samsung) that cut off the network or its SDKs. Research reports alone, and services that simply went offline without an announced action, are not included.

Inclusion describes an official action and what the acting authority or company said about it. It is not a verdict about any company, and it says nothing about any current company beyond the cited source. Criminal charges are allegations; every defendant is presumed innocent unless and until proven guilty. Civil complaints are one side's claims.

Every figure is attributed to the source that states it and copied as stated. Figures are not comparable across rows: some count devices, some IP addresses, some proxies on sale, and they cover different periods.

Primary announcements describe what authorities or acting companies said on their publication dates. A source being available today does not establish that a service remains offline or that charges ended in conviction. News-only details remain attributed and need their stated additional source.

The 2026-10-16 targeted review read substantive DOJ article text through public web captures where native HTTP 200 responses were access-denied shells. It also read the named Google/Lumen/BSI reports and the two attributed LG/Samsung news reports. The private audit records withdrawals and remaining source gaps; no row-wide date was silently advanced.

A blank cell means no source I could verify states that value. I never estimate one. Dates are the action date where published, otherwise the announcement date, noted in the row.

Brands appear only when the cited source names them. Where only secondary reporting links a brand to an action, the brand is left out of the table.

Dates and device/IP totals have different meanings across rows. Some later criminal outcomes and additional third-party/SEC details were not reverified; see row notes.

On 2026-11-12 I re-read the cited sources for Glupteba, NSOCKS/ngioweb, BadBox (BSI), BadBox 2.0, IPIDEA, the Dutch 17-million-device botnet, NetNut, LG and Samsung and moved those rows to that date; the NetNut row also gained Alarum's November 5 proxy statement. I added Google's November 3 XCPE action. The DOJ articles (RSOCKS, IPStorm, 911 S5, Anyproxy/5socks, SocksEscort, Aisuru/KimWolf, QTRouter) returned empty pages to my fetches and HUMAN's PROXYLIB report returned 403, so those rows keep their 2026-09-27 date; a separate browser read that day confirmed the 911 S5, Anyproxy/5socks and IPStorm dates, arrests or pleas, and charges, but not every figure in those rows. My searches that day found no later plea, sentence or new official action for those cases, which is a search limit, not proof that none exists. The NetNut domain still showed a "Seized by the Federal Bureau of Investigation" banner on 2026-11-12; that is the July seizure, not a new action.

How to cite this dataset

Residential proxy takedowns tracker. Crawlfolio, updated . https://crawlfolio.com/data/residential-proxy-takedowns/. Licensed CC BY 4.0. Reuse it with credit and a link to this page.

Sources

18 sources, accessed to .

Official pricing, docs, changelogs and status pages 16

  1. Google: New action to combat cyber crime blog.google · accessed
  2. DOJ (S.D. Cal.): Russian botnet disrupted in international cyber operation justice.gov · accessed
  3. DOJ (D.P.R.): Russian and Moldovan national pleads guilty to operating illegal botnet proxy service justice.gov · accessed
  4. HUMAN Satori actual PROXYLIB/LumiApps report, 26 March 2024 humansecurity.com · accessed
  5. DOJ: 911 S5 Botnet Dismantled and Its Administrator Arrested in Coordinated International Operation justice.gov · accessed
  6. Lumen Black Lotus Labs: the use and abuse of the NSOCKS botnet lumen.com · accessed
  7. BSI press release: BSI weist auf vorinstallierte Schadsoftware auf IoT-Geräten hin bsi.bund.de · accessed
  8. DOJ (N.D. Okla.) press release on the Anyproxy and 5socks botnet justice.gov · accessed
  9. Google: We're taking legal action against the BadBox 2.0 botnet blog.google · accessed
  10. Google Threat Intelligence Group: Disrupting the largest residential proxy network cloud.google.com · accessed
  11. DOJ (E.D. Cal.): Authorities dismantle global malicious proxy service that deployed malware justice.gov · accessed
  12. DOJ (D. Alaska): Authorities disrupt world's largest IoT DDoS botnets justice.gov · accessed
  13. Politie: Politie en NCSC halen groot botnetwerk offline politie.nl · accessed
  14. Google Threat Intelligence Group: Google's Continued Disruption of Malicious Residential Proxy Networks cloud.google.com · accessed
  15. DOJ: Justice Department and FBI Seize Platforms Operated and Used by China State-Sponsored Hackers to Target U.S. Critical Infrastructure justice.gov · accessed
  16. Google Threat Intelligence Group: Shutting the door on the XCPE botnet cloud.google.com · accessed

News and press 2

  1. KrebsOnSecurity: LG to Ban Residential Proxies from Smart TV Apps krebsonsecurity.com · accessed
  2. TechCrunch: Samsung bans smart TV apps that share users' internet connections with strangers techcrunch.com · accessed