Browse
Log in / Register
Share
March 18, 2025
Dutch authorities have taken down a proxy service that quietly turned 178,000 infected devices into a criminal traffic network. The Dutch National Police, the Netherlands Public Prosecutor’s Office, and the Shadowserver Foundation said the service gave criminals the ability to hide their tracks behind ordinary residential IP addresses. The operation included server actions at multiple hosting providers, and the service’s website now shows a law-enforcement takedown notice. More servers are expected to be disabled in the near future.
A proxy server is an intermediary. Instead of connecting directly to a website, a user’s traffic goes to the proxy first, and then the proxy forwards it to the destination. The destination sees the proxy’s IP address, not the user’s real one. That arrangement is useful for privacy, bypassing regional content blocks, or testing how a site looks in another country. But the same mechanism is a gift to criminals when the proxy devices are hijacked.
This takedown was not about companies or journalists using privacy tools. It was about a criminal proxy service using infected, unsuspecting devices. The scale matters: 178,000 compromised machines creates a giant pool of “clean” IP addresses that look like normal homes and businesses. That makes attacks much harder to trace.
Cybercriminals want residential IP addresses because fraud systems usually trust them. A login from a data center IP address is often flagged. A login from a home IP address looks like a real customer. With 178,000 devices scattered around the world, criminals could appear to be anywhere at any time.
The danger is not just for banks or online stores. When an attacker uses a victim’s router or webcam as a proxy, the victim’s IP address can end up in the logs of a criminal investigation. Police may see that address connected to fraud, credential stuffing, or other malicious activity. The actual criminal remains hidden behind the proxy. The innocent device owner becomes a suspect.
Dutch police highlighted exactly this risk in their statement. Users of the service could connect to the internet through the compromised devices without the owners knowing. If criminals used the service, the IP addresses of innocent citizens and businesses could be wrongly marked as suspicious during criminal investigations.
The police did not disclose the infection method. That is common in takedowns because the technical details are shared with security teams and ISPs rather than made public. Still, the pattern from similar proxy networks is well known.
Most home routers, smart cameras, DVRs, and other internet-connected devices are not patched often. Many still use default or weak admin passwords. If a device is exposed to the internet and has an open remote-management feature, it becomes an easy target. An attacker can log in, install a small program, and add the device to a proxy pool. The owner rarely notices anything unusual. Internet speed might dip, but most people do not associate that with someone else using their connection.
The Dutch National Police, the Netherlands Public Prosecutor’s Office, and the Shadowserver Foundation worked together on the operation. Shadowserver is a nonprofit security organization that helps make the internet safer by scanning, analyzing, and sharing data on compromised systems. Its role in takedowns is often behind the scenes: identifying infrastructure, tracking botnets, and helping network owners clean up infections.
The service’s website now shows a splash page stating that it was taken down by the Dutch authorities and Shadowserver. That is also a way to send a message to the service’s users. Someone trying to connect to the proxy network will see that the operation has been dismantled, which erodes trust in the underground service and makes future attempts harder.
Dutch police also stressed that cybercrime is not fought only through arrests. By collecting and analyzing data, sharing intelligence, and cooperating with international partners, police can disrupt criminal operations before they cause more harm. This takedown fits that strategy.
The latest operation follows a familiar pattern. In a previous case, Dutch police worked with the FBI to take down SocksEscort, a proxy service that had quietly hijacked 369,000 WiFi routers and other devices. That service also allowed criminals to hide traffic behind residential IP addresses.
Together, these cases show that law enforcement is paying closer attention to residential proxy services. These networks sit in a gray area at first: the infrastructure itself is just a set of devices. What makes it criminal is consent. A legitimate proxy provider uses servers or devices that owners have approved. A criminal proxy network uses devices without the owner’s knowledge. That distinction is clear to police, and they are now treating these networks as serious infrastructure for crime.
This operation was led by Dutch authorities, but proxy networks do not respect borders. Criminals route traffic through whatever devices they can compromise, including routers and smart devices in the United States. A home camera with a default password is not just a privacy risk; it can become a node in an international proxy network.
For most people, the risk is invisible. The device sits in a closet or on a shelf, and the traffic passes through it without any obvious sign. That is why proactive security checks matter.
Here are some practical steps for households and small businesses:
Businesses should also keep an eye on devices that are not obviously important. Office printers, doorbell cameras, and building sensors all have IP addresses. They can be compromised and used in a proxy network just like a PC.
The exact number of affected devices is huge, but the fix is not complicated. It comes down to basic hygiene: update software, change defaults, and reduce exposure to the internet. In many cases, criminals are not using sophisticated zero-day exploits. They are relying on public knowledge, weak credentials, and neglect.
For people who worry their device may have been part of this network, the best starting point is to contact their internet service provider. ISPs involved in the cleanup may have received lists of affected IP addresses. A quick router scan, a password change, and a firmware update can remove the device from a proxy pool and prevent it from being used again.
The takedown of this 178,000-device proxy network is another sign that law enforcement is learning how to attack cybercrime infrastructure rather than chasing every individual criminal. Seizing servers, publishing takedown notices, and sharing data with security organizations can disrupt the market for proxy services. It makes criminals pay for new infrastructure, rebuild their networks, and risk exposing themselves again.
Dutch police did not release the name of the proxy service or detailed technical indicators. Those details were likely shared privately with organizations that can scan for other infected devices. The investigation is ongoing, and more infrastructure may be dismantled in the coming weeks.
For now, the takeaway is simple. Every internet-connected device is a potential weapon if it is left unprotected. Police can take down a network, but preventing the next one depends on device owners taking basic security steps. That responsibility is now part of everyday internet use.
