INTEL_REPORT
Mandiant / Google Threat Intelligence Blog · published 1/28/2026, 2:00:00 PM · TLP amber
Summary
Ingested excerpt (first ~500 chars of normalized text).
No Place Like Home Network: Disrupting the World's Largest Residential Proxy Network Introduction This week Google and partners took action to disrupt what we believe is one of the largest residential proxy networks in the world, the IPIDEA proxy network. IPIDEA’s proxy infrastructure is a little-known component of the digital ecosystem leveraged by a wide array of bad actors. This disruption, led by Google Threat Intelligence Group (GTIG) in partnership with other teams, in…
https://cloud.google.com/blog/topics/threat-intelligence/disrupting-largest-residential-proxy-network
sha256:6d1c822746b8049e74aa065fd31f59bb02606feb814e1e8253a8b5fca5486504
What we pulled out
Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).
Indicators
Linked with report → mentions → indicator. Values open the indicator workspace.
Malware families
Allowlist token matches only.
Threat actors mentioned
Allowlist mentions — not a formal attribution verdict.
ATT&CK techniques
MITRE IDs referenced in text and present in local technique table.
CONTINUE INVESTIGATION
High-signal pivots without leaving the thread you started in search.
Browse the report corpus.
Neighborhood from the first linked indicator.
| Open → |
| domain | cherryproxy.com | Open → |
| domain | doorvpn.com | Open → |
| domain | galleonvpn.com | Open → |
| domain | ip2world.com | Open → |
| domain | ipidea.io | Open → |
| domain | lunaproxy.com | Open → |
| domain | piaproxy.com | Open → |
| domain | pyproxy.com | Open → |
| domain | radishvpn.com | Open → |
| domain | tabproxy.com | Open → |
| domain | castarsdk.com | Open → |
| domain | earnsdk.io | Open → |
| domain | hexsdk.com | Open → |
| domain | packetsdk.com | Open → |
| domain | www.google.com | Open → |
| domain | api-seed.packetsdk.xyz | Open → |
| domain | api-seed.packetsdk.net | Open → |
| domain | api-seed.packetsdk.io | Open → |
| domain | dispatch1.hexsdk.com | Open → |
| domain | cfe47df26c8eaf0a7c136b50c703e173.com | Open → |
| domain | 8b21a945159f23b740c836eb50953818.com | Open → |
| domain | 31d58c226fc5a0aa976e13ca9ecebcc8.com | Open → |
| domain | holadns.com | Open → |
| domain | martianinc.co | Open → |
| domain | okamiboss.com | Open → |
| domain | v46wd6uramzkmeeo.in | Open → |
| domain | 6b86b273ff34fce1.online | Open → |
| domain | 0aa0cf0637d66c0d.com | Open → |
| domain | aa86a52a98162b7d.com | Open → |
| domain | 442fe7151fb1e9b5.com | Open → |
| domain | bdrv7wlbszfotkqf.uk | Open → |
| domain | 00857cca77b615c369f48ead5f8eb7f3.com | Open → |
| domain | 3k7m1n9p4q2r6s8t0v5w2x4y6z8u9.com | Open → |
| domain | 7x2k9n4p1q0r5s8t3v6w0y2z4u7b9.com | Open → |
| domain | 8f00b204e9800998.com | Open → |
| domain | a7b37115ce3cc2eb.com | Open → |
| domain | a8d3b9e1f5c7024d6e0b7a2c9f1d83e5.com | Open → |
| domain | af4760df2c08896a9638e26e7dd20aae.com | Open → |
| domain | b5e9a2d7f4c8e3b1a0d6f2e9c5b8a7d.com | Open → |
| domain | e4f8c1b9a2d7e3f6c0b5a8d9e2f1c4d.com | Open → |
| domain | packetsdk.io | Open → |
| domain | packetsdk.net | Open → |
| domain | packetsdk.xyz | Open → |
| domain | willmam.com | Open → |
| md5 | 993ae4fe78b879239bdc14dfbc0963cd | Open → |
| md5 | 0c855f87a7574b28df383eca5084fcdc | Open → |
| md5 | c8eb024c053f82831f2738bd48afc256 | Open → |
| md5 | 8a9bd7e7a806b2cc606b7a1d8f495662 | Open → |
| md5 | cfe47df26c8eaf0a7c136b50c703e173 | Open → |
| md5 | 8b21a945159f23b740c836eb50953818 | Open → |
| md5 | 31d58c226fc5a0aa976e13ca9ecebcc8 | Open → |
| md5 | 00857cca77b615c369f48ead5f8eb7f3 | Open → |
| md5 | a8d3b9e1f5c7024d6e0b7a2c9f1d83e5 | Open → |
| md5 | af4760df2c08896a9638e26e7dd20aae | Open → |
| sha256 | aef34f14456358db91840c416e55acc7d10185ff2beb362ea24697d7cdad321f | Open → |
| sha256 | b0726bdd53083968870d0b147b72dad422d6d04f27cd52a7891d038ee83aef5b | Open → |
| sha256 | 2d1891b6d0c158ad7280f0f30f3c9d913960a793c6abcda249f9c76e13014e45 | Open → |
| sha256 | 59cbdecfc01eba859d12fbeb48f96fe3fe841ac1aafa6bd38eff92f0dcfd4554 | Open → |
| sha256 | ba9b1f4cc2c7f4aeda7a1280bbc901671f4ec3edaa17f1db676e17651e9bff5f | Open → |
| sha256 | 01ac6012d4316b68bb3165ee451f2fcc494e4e37011a73b8cf2680de3364fcf4 | Open → |