What happened to IPIDEA in January 2026
In late January 2026, Google's Threat Intelligence Group announced a court-ordered action against domains associated with IPIDEA, a China-based operator of what Google described as one of the largest residential proxy networks in the world. The action was coordinated with Cloudflare, Spur and Lumen's Black Lotus Labs, and was accompanied by Google Play Protect removing Android applications that embedded IPIDEA's monetisation SDKs. Google stated the disruption reduced the available device pool by millions and materially degraded the network's operations.
IPIDEA publicly disputed Google's characterisation. The company said it had not been contacted before publication, that applications using its SDK were required to disclose exit-node use to the user on first launch, and that it operated know-your-customer checks and a blacklist of high-risk destination domains. It denied operating the botnets named in the reporting, while acknowledging that some of its resellers did not strictly implement its KYC requirements. Nothing here is settled in a court of final judgment, and this page takes no position on it.
The practical consequence is what matters if you are reading this: IPIDEA's own domains stopped resolving, and a number of the storefronts built on its network went offline or entered rebuild. Independent measurement suggests the underlying device pool did not disappear entirely, but the commercial front end that most customers bought through was interrupted.
Brands that ran on the IPIDEA network
The structurally distinctive thing about IPIDEA was that it was rarely the name on the invoice. It functioned as a wholesale supply layer, with separately branded, seemingly independent storefronts sitting on top of the same infrastructure. Google's filing identified thirteen proxy and VPN brands as running on that shared backend. If you bought from one of them, you were buying IPIDEA capacity even if you had never heard the name.
Check the list below against whatever dashboard you were logging into. This is the single most useful diagnostic for anyone whose proxies stopped behaving in early 2026 and who could not work out why.
- 360 Proxy
- 922 Proxy
- ABC Proxy
- Cherry Proxy
- IP2World
- Luna Proxy
- PIA S5 Proxy
- PyProxy
- Tab Proxy
- The VPN apps Door VPN, Galleon VPN and Radish VPN
What IPIDEA did well and what a replacement must cover
It is worth being straight about this, because it explains why people used it and what a replacement actually has to cover. IPIDEA's pool was very large and, more importantly, unusually deep in places that are genuinely hard to source: Brazil, India and other high-population emerging markets where most Western-facing providers are thin. If your work depended on that depth, you were not using IPIDEA because it was cheap; you were using it because the alternatives could not fill the request volume.
The commercial model was also permissive in ways engineers liked. Concurrency was effectively unmetered, targeting reached city and ASN level, and the per-IP SOCKS5 purchasing model offered by some of the family brands let you buy discrete addresses rather than bandwidth — a workflow that suits account-shaped tasks far better than a per-GB meter does. Self-serve signup and round-the-clock support meant you could be running the same day.
Any honest comparison has to concede that no single mid-sized provider replaces all of that at once.
How Nefo differs: one brand, prepaid bandwidth
Nefo sells directly under one brand: you buy from the company that runs the service and answers for it, with one account, one balance and one support team. That is a structural difference rather than a feature, and after the events above it is the one that most former IPIDEA customers care about.
The commercial model is prepaid bandwidth rather than subscription. You buy a volume — from 5GB — generate credentials at no cost, and consume the balance only as traffic passes through. Flexible plans are non-expiring, so an unused balance stays in the account rather than resetting monthly. That suits intermittent or seasonal workloads, and it makes a low-risk evaluation possible: buy the smallest volume, point your existing code at it, and measure.
- HTTP, HTTPS and SOCKS5, with username/password or IP allowlist authentication
- 227 countries; state or region and city targeting in most of them
- ASN/ISP targeting paired with a country, for a specific cable, fibre or mobile carrier
- Rotating sessions with a new IP per request, or sticky sessions held from 1 minute to 24 hours, configurable per credential
- 440,652 unique residential exits seen in a three-day sample of our own, more than 3,500,000 over fourteen days
- Separate 4G/5G mobile product: a port on a real carrier modem with one live rotating mobile IP, rented per duration rather than per GB
How to move an IPIDEA-era setup to Nefo
For per-GB rotating traffic the move is mostly a credential swap. Nefo authenticates by username and password or IP allowlist on all protocols, so if your scraper already speaks HTTP or SOCKS5 with credentials in the proxy URL, you change the host, port and credential and the rest of the code stands. Country, state, city and ASN selection is set when you generate the credential rather than passed as a per-request parameter, so plan one credential per targeting profile.
The awkward case is the per-IP SOCKS5 workflow. If your tooling held a list of individually purchased addresses and treated each as a durable identity, the closest mappings now depend on how long you needed to keep each IP: sticky residential sessions if hours are enough, a static residential ISP IP if you need a dedicated home-ISP address for 7 to 360 days, IP Vault if you need to keep a residential or mobile IP longer term, a mobile port if you want one live mobile IP you can change on demand, or a static IP if a fixed datacenter address fits the job better. Which fits depends on whether the address needed to persist for hours, weeks or months, and whether it had to stay residential/mobile rather than datacenter-hosted.
One more thing to check before you migrate anything: Nefo supports both username/password auth and an IP allowlist, so tooling that only supports IP allowlisting works once you add its IPs.
- Buy 5GB and run your existing job against it unmodified before touching anything else
- Create one credential per country/state/ASN profile you currently target
- Map rotating traffic first; it is the part that ports cleanly
- Decide whether per-IP workflows become sticky sessions or a time-rented mobile port
- Re-baseline success rates on your own targets rather than trusting anyone's headline figure
- Confirm your client library supports username/password proxy auth, or add its IP to the allowlist
When Nefo is not the right IPIDEA replacement
If your workload depended on extreme depth in a small number of emerging markets at very high monthly volume, a bandwidth-metered mid-sized network will not reproduce that, and you should be talking to providers who specialise in those regions. The same applies if your architecture depends on products Nefo still does not sell, such as a managed scraping API.
There is also a reasonable case for waiting rather than moving. Several of the affected storefronts have been restoring service. If yours is back, your volumes are large, your integration is deep and your compliance position is settled, switching costs may not be worth paying on this timeline. Migrate because the model fits, not because of a news cycle.
Conversely, if you were a smaller customer who valued being able to buy a modest amount of bandwidth, target precisely, and not think about it again for a month, the prepaid non-expiring model is a better structural fit than a subscription — and knowing exactly who you are buying from is worth something on its own.
Questions to ask any proxy provider before you switch
The most durable lesson from January 2026 is not about any one brand. It is that a proxy storefront and a proxy network can be different companies, and that the reseller layer can hide both who runs the infrastructure and how the addresses were obtained. Ask directly, in writing, before you commit budget. A reputable provider should be able to answer these without hedging.
Nefo publishes an acceptable use policy that prohibits spam, credential stuffing, payment fraud, phishing, malware distribution, network attacks and unauthorised access, and suspends accounts that breach it. Enforcement of that kind is not a marketing feature; it is what keeps a pool usable, because a network that tolerates abuse is a network whose IPs end up on blocklists you then have to work around.
- Do you operate this network, or are you reselling someone else's?
- What is your acceptable use policy, and what actually triggers a suspension?
- Is my balance metered by bandwidth, by IP, or by subscription period — and does it expire?
- Can I test on a small prepaid volume without a sales call or a commitment?
- What targeting granularity is available in the specific countries I need, not in aggregate?
- Which protocols and authentication methods do you support?
Frequently asked questions
IPIDEA's primary domains stopped resolving after the January 2026 court action, and several storefronts on its network went offline or entered a rebuild. Some have since restored service in some form. Check the specific brand you bought from and raise any unused balance with that storefront's support.
Google's filing named thirteen proxy and VPN brands on the same infrastructure, including 360 Proxy, 922 Proxy, ABC Proxy, Cherry Proxy, IP2World, Luna Proxy, PIA S5 Proxy, PyProxy and Tab Proxy. If you bought from any of them, you bought IPIDEA capacity through a separate storefront.
For most smaller and intermittent users, yes: one brand, prepaid bandwidth from 5 GB, 227 countries and state, city and ASN targeting in most countries. It is not a match if you needed extreme depth in a few emerging markets at very high volume or a managed scraping API.
Not in the same way. Residential bandwidth is metered, but Nefo also sells static residential ISP IPs and static IP proxies per address, plus IP Vault for keeping a residential or mobile IP longer, plus sticky sessions up to 24 hours. Choose by how long each address must persist.
For rotating per-GB traffic, generally yes. Nefo uses HTTP, HTTPS and SOCKS5 with username and password or an IP allowlist, so you change the endpoint and credential. Geo and ASN targeting is set when you generate the credential, so create one credential per targeting profile.
No. Nefo is prepaid: buy from 5 GB, generate credentials free, and only traffic consumes the balance. Flexible plans do not expire, so a small purchase is enough to benchmark your own targets. See pricing.