19 million addresses nobody noticed. When the U.S. Department of Justice announced the takedown of the 911 S5 botnet in May 2024, the headline figure was scale: more than 19 million unique IP addresses in roughly 190 countries, 613,841 of them in the United States.
The delivery mechanism was more instructive. The malware did not arrive through phishing or an unpatched server. It shipped inside free VPN apps called MaskVPN, DewVPN, ShieldVPN and a handful of others, often bundled with pirated games..
Users got a VPN that worked. The operation, allegedly run by YunHe Wang, got an exit node on every machine and sold access to customers who wanted their traffic to look like it came from an ordinary living room. Investigators linked the network to billions in losses, including tens of thousands of fraudulent pandemic-relief claims..
Paying changes the incentive, not the proof. Most coverage boiled the story down to “avoid free VPNs.” A subscription changes who the customer is, not whether the operator is competent. The better filter is evidence: an independent audit with a date on it, a named jurisdiction, apps that stop traffic when the tunnel drops instead of leaking DNS requests.
Gizmodo’s editors ran providers through that kind of scrutiny, and their notes on which paid VPNs held up best in hands-on testing are a sensible starting point for anyone replacing an app installed on impulse.. Why a home IP address is worth money. Residential IPs are valuable because they look boring.
Anti-fraud systems and bot filters treat data-center ranges with suspicion, while traffic from an Orange or Comcast subscriber sails through. That makes household connections raw material for ad fraud, credential stuffing, ticket bots and, more and more, large-scale scraping for AI training data, where being blocked is the main operating cost..
Plenty of the residential proxy market is legal. Vendors sell bandwidth openly, and some source it through SDKs embedded in free apps, with consent buried somewhere in the terms of service. The distance between a “bandwidth-sharing” feature and a botnet can be one pre-ticked box..
The economics explain the rest. Residential proxies are usually billed by the gigabyte, at a premium over data-center addresses, because they are harder to detect and harder to replace. An operator who never paid for the hardware, the electricity or the broadband line keeps nearly all of that margin.
According to the Justice Department, 911 S5 earned its administrator roughly $99 million.. A study the downloads ignored. Researchers had flagged the pattern.
In 2016, a team from CSIRO‘s Data61 and UNSW analyzed 283 Android VPN apps: 38% showed some malware presence, 18% did not encrypt traffic at all, and 84% leaked IPv6 traffic. The FBI still maintains a removal guide for the 911 S5 applications, which suggests plenty of copies are still out there..
The paper got cited. The apps kept getting downloaded.. The symptoms on an enrolled machine are dull: a fan spinning at 3 a.m., upload traffic nobody can account for, a home connection suddenly hitting CAPTCHAs everywhere because someone else burned its reputation.
Few people trace any of that back to the app they installed to feel safer.. The asset missing from every privacy dashboard. Data-economy debates usually focus on what platforms collect: clicks, location, purchase history.
911 S5 points at something else entirely, the connection itself. A household’s IP reputation, bandwidth and apparent geography can be packaged and resold without ever appearing in a settings menu. As AI companies compete for fresh web data and publishers tighten bot filtering in response, demand for clean residential addresses will keep climbing.
The next network built this way probably won’t call itself a VPN at all. A free weather widget would do the job, and the invoice would once again go to someone else.. Featured image credit.
Tags: trends
