Ipidea

Ipidea is a China-based company associated with residential proxy services, consumer VPN applications, and software-development kits used by third-party applications. Its infrastructure became the subject of extensive public scrutiny after Google researchers reported that the company controlled millions of residential Internet connections through PCs, smartphones, Android TV devices, and other consumer hardware. Those connections were allegedly used as proxy exit nodes for traffic originating from other businesses and Internet users. The company’s apparent business model combined direct-to-consumer VPN products with monetisation software for application developers. Publicly identified VPN brands associated with Ipidea include DoorVPN, Galleon VPN, Radish VPN, Aman VPN, 922 Proxy, 360 Proxy, and Luna Proxy. Researchers said that some of these services did not clearly explain to users that installing or operating the applications could convert their devices into nodes within a commercial proxy network. Ipidea also marketed SDKs under names including Castar SDK, Earn SDK, Hex SDK, and Packet SDK. These tools were promoted to developers as ways to generate revenue, with payments commonly linked to application downloads. According to Google’s reporting, applications embedding the SDKs could enroll devices as proxy nodes without sufficiently clear user knowledge or consent. Google Threat Intelligence Group identified more than 600 Android applications and 3,075 Windows binaries that communicated with Ipidea-controlled infrastructure. Some Windows files reportedly imitated familiar system or productivity tools, while some low-cost Android television boxes allegedly shipped with related proxy software already installed. The network used a two-level command-and-control structure: an initial server supplied configuration information and addresses for secondary servers, while those secondary servers assigned proxying tasks and relayed traffic. Researchers identified approximately 7,400 second-tier servers distributed around the world, which they said indicated centralized management despite the use of numerous brands and domains. The network was also linked in public reporting to abuse by criminal and state-sponsored threat actors. Google connected Ipidea infrastructure to investigations involving the BadBox 2.0 and Aisuru botnets, while researchers separately reported that the Kimwolf botnet exploited a vulnerability in Ipidea’s infrastructure to reach Internet of Things devices behind residential firewalls. In January 2026, Google obtained a court order requiring dozens of Ipidea-owned domains to be removed from the Internet. Google described the operation as one of the largest residential proxy networks it had observed at that time. Ipidea rejected the characterization that it intentionally operated a malicious network. The company said third parties could abuse any open network, claimed to operate know-your-customer procedures involving identity and facial verification, and said it blocked more than 3.4 million high-risk domains. It also denied operating or providing technology for BadBox 2.0 and said it closed Kimwolf’s access after receiving a vulnerability report in late December 2025. The controversy has made Ipidea a prominent example in debates over informed consent, software monetisation, residential proxy sourcing, and accountability in the proxy industry. The company’s corporate ownership, founding history, leadership, and current operating status are not clearly established in the supplied reference material.

Publicly available information about Ipidea’s founding, ownership, corporate structure, and early development is limited. The company is primarily known through its Internet infrastructure and associated product brands rather than through a well-documented corporate history. Its apparent operations included residential proxy services, consumer VPN products, and monetisation SDKs distributed through third-party software. The central feature of the business was a pool of residential IP addresses. Google researchers reported that Ipidea obtained control over millions of consumer devices, including computers, smartphones, and television set-top boxes, and used them as proxy exit nodes. Some devices were reportedly enrolled through VPN applications that did not clearly explain the proxy function. Others were allegedly enrolled after applications incorporated Ipidea’s Castar, Earn, Hex, or Packet SDKs. These SDKs were promoted as monetisation tools for developers and supported Android, Windows, iOS, and LG WebOS environments. The reported commercial arrangement commonly compensated developers according to application downloads. Google identified hundreds of Android applications and thousands of Windows binaries communicating with Ipidea infrastructure. Some files were reported to resemble legitimate operating-system or cloud-storage utilities. Researchers also described a two-stage command-and-control design in which an initial server supplied configuration information and secondary server addresses, after which secondary servers coordinated proxy tasks. Approximately 7,400 secondary servers were identified globally. This architecture allowed many domains and commercial brands to appear separate while remaining connected to a common operational network. Ipidea’s infrastructure later appeared in investigations of several botnets. Google reported links to BadBox 2.0, a botnet involving more than 10 million uncertified Android devices, while Aisuru reportedly used the proxy pool during operations associated with distributed denial-of-service activity. Researchers also said that Kimwolf exploited a vulnerability to use Ipidea nodes as a route toward Internet of Things devices located behind home firewalls. These reports raised concerns beyond ordinary proxy abuse because device owners could face reputational damage, ISP blocking, or the risk of lateral compromise within their home networks. In January 2026, Google obtained a court order targeting dozens of Ipidea-owned domains. Google characterized the network as among the largest residential proxy systems it had observed. The company disputed allegations of malicious intent, stated that it used customer verification procedures, and said it blocked millions of high-risk domains. Ipidea also said that third parties could misuse an otherwise open network and denied responsibility for BadBox 2.0. It reported that access connected with the Kimwolf vulnerability was closed after notification. The episode contributed to a broader reassessment of residential proxy businesses. Industry observers reported that Ipidea-linked or suspected brands had helped popularize low-cost, unlimited-bandwidth proxy plans and had influenced competition from 2022 to 2024. Later testing also suggested that portions of the underlying device pool might remain active through installed SDKs and applications even after prominent domains were disrupted. Because independent confirmation of Ipidea’s legal identity, leadership, and current operations is limited, its present corporate status remains uncertain.

• 2026

  Google reports the scale of the Ipidea proxy network

  [1]Ipideaen.wikipedia.org

  Google identified more than 600 Android applications, 3,075 Windows binaries, and approximately 7,400 second-tier servers associated with the network.

• 2026

  Court order removes Ipidea-associated domains

  [1]Ipideaen.wikipedia.org

  Google obtained a court order requiring dozens of domains associated with Ipidea to be taken offline.

• 2025

  Ipidea infrastructure appears in botnet investigations

  [1]Ipideaen.wikipedia.org

  Public security reporting connected Ipidea infrastructure with investigations involving BadBox 2.0, Aisuru, and Kimwolf, while Ipidea disputed responsibility for the botnets.

• 2025

  Kimwolf access is reported and addressed

  [1]Ipideaen.wikipedia.org

  Researchers reported that Kimwolf used a vulnerability in Ipidea infrastructure. Ipidea said the weakness was confined to a legacy testing module and that access was closed after notification in December.

• 2022

  Ipidea-linked proxy brands influence low-cost residential proxy competition

  [1]Ipideaen.wikipedia.org

  Industry reporting attributed a wave of low-priced proxy entrants and fixed-fee unlimited-bandwidth plans to Ipidea and related brands during the 2022–2024 period.

A proxy and application-monetisation provider positioned around access to residential IP addresses and developer revenue tools. Public reporting has focused less on conventional brand marketing than on the scale, sourcing, disclosure practices, and security implications of its network.

• Proxy services

  Residential proxy network

  Ipidea was associated with a large network of residential IP addresses routed through consumer devices. The network was made available for proxy traffic and was reportedly managed through a distributed two-tier control architecture.

• VPN services

  Consumer VPN brands

  Public reporting identified DoorVPN, Galleon VPN, Radish VPN, Aman VPN, 922 Proxy, 360 Proxy, and Luna Proxy as VPN or proxy brands associated with Ipidea. Researchers raised concerns that some products did not clearly disclose device enrollment in the proxy network.

• Software development kit

  Castar SDK

  Castar SDK was identified as one of Ipidea’s application monetisation tools. Third-party developers could embed it in software, with reported compensation linked to downloads. Researchers said applications using such SDKs could enroll installed devices as proxy nodes.

• Software development kit

  Earn SDK

  Earn SDK was marketed as a developer monetisation component and was associated with Ipidea’s proxy-enrollment infrastructure. Its reported role was to help add application users’ devices to the residential proxy pool.

• Software development kit

  Hex SDK

  Hex SDK was another Ipidea-linked software component used in third-party applications. Security reporting associated the SDK family with device enrollment and communications with Ipidea control infrastructure.

• Software development kit

  Packet SDK

  Packet SDK was identified as an Ipidea monetisation and networking component. It was reported to support the conversion of devices running participating applications into proxy-network nodes.

• 2026

  Residential proxy network and consent controversy

  Google researchers alleged that Ipidea enrolled millions of consumer devices into a commercial proxy network through VPN products and third-party SDKs without sufficiently clear disclosure. The allegations created wider debate about consent and ethical sourcing in residential proxies.

  Source

• 2026

  Google domain takedown

  Google obtained a court order directing the removal of dozens of domains associated with Ipidea, making the company the focus of a major infrastructure disruption.

  Source

• 2025

  Reported links to BadBox 2.0 and other botnets

  Security reporting connected Ipidea infrastructure with BadBox 2.0, Aisuru, and Kimwolf activity. Ipidea denied operating or controlling BadBox 2.0 and said it restricted access associated with Kimwolf after notification.

  Source

Read more

• 2026

  Ipidea contests Google’s characterization of its networkStrategy

  Background

  Google’s reporting described Ipidea as operating a very large residential proxy network that could be abused by criminal and state-linked actors.

  Action taken

  Ipidea denied malicious intent, emphasized its claimed KYC and domain-blocking controls, and argued that third parties could misuse an open network.

  Aftermath

  The dispute remained part of the broader debate over proxy-provider accountability and the adequacy of user disclosure.

  Source

• 2026

  Google pursues removal of Ipidea-associated domainsOther

  Background

  Google reported that Ipidea’s infrastructure supported a large proxy network and was used by numerous threat groups.

  Action taken

  Google obtained a court order requiring dozens of Ipidea-owned domains to be removed from the Internet.

  Aftermath

  The action disrupted prominent domains, although subsequent industry testing suggested that some enrolled devices and proxy capacity might remain active through installed applications and SDKs.

  Source

• 2025

  Ipidea closes reported Kimwolf access pathOther

  Background

  Researchers reported that Kimwolf exploited a vulnerability in Ipidea infrastructure to use proxy nodes as a route toward local-network devices.

  Action taken

  Ipidea said it closed the access after receiving a vulnerability report and stated that the issue was confined to a legacy testing module.

  Aftermath

  The incident intensified concerns about the security boundaries of residential proxy networks and the risks to devices located behind home firewalls.

  Source

1. 1Ipideaen.wikipedia.org
2. 2Ipidea official websiteipidea.org