IPIDEA

IPIDEA operates the largest known residential proxy network, referred to internally as HK_NETWORK. In January 2026, Google disrupted IPIDEA's operations through legal proceedings, domain takedowns, and enforcement actions targeting software development kits (SDKs).

IPIDEA acquires devices through multiple SDKs embedded in consumer applications, such as CastarSDK, EarnSDK, HexSDK, and PacketSDK. The network uses a two-tier command-and-control architecture: Tier 1 domains facilitate device enrollment, with over 5000+ Tier 2 IP-based servers coordinate proxy tasking globally.

IPIDEA manages several proxy brands that serve as front services, including 360 Proxy, 922 Proxy, ABC Proxy, Cherry Proxy, IP2World, Luna Proxy, PIA S5 Proxy, and PyProxy.

IPIDEA's infrastructure has been associated with the BadBox2.0, Aisuru, and Kimwolf botnets. According to Synthient's research, 67% of Android devices within IPIDEA's pool were unauthenticated, rendering them susceptible to remote code execution. The Kimwolf botnet exploited this vulnerability to compromise more than 2 million devices via DNS rebinding via IPIDEA's network. IPIDEA addressed the vulnerability on December 28, 2025, following Synthient's notification.