The original 922proxy.com is unavailable after Google's IPIDEA disruption. Here is what is verified, what remains uncertain, and how former users should respond.
Jul 9, 2026 · Updated Jul 9, 2026
Also in: Русский
Updated July 10, 2026: This status applies to the original service at
922proxy.com. New websites using the 922 name should not automatically be treated as its official continuation.
The original 922 Proxy, also known as 922 S5 Proxy, is unavailable. Its primary domain no longer resolves normally and its registration record shows clientHold, a status that removes a domain from the DNS zone. The record was updated on January 28, 2026, the day Google Threat Intelligence Group announced a coordinated disruption of the IPIDEA residential proxy network.
Google explicitly listed 922 Proxy among 13 apparently independent proxy and VPN brands controlled by the actors behind IPIDEA. For a former customer, the practical conclusion is clear: the old website, dashboard, client and endpoints cannot be treated as a functioning service.
That does not prove that every server, IP address or operator connected with the wider network disappeared forever. Google described significant degradation, not complete eradication. Its later reporting also noted that disrupted residential networks may buy capacity from competitors, return as resellers or reappear under new names.
922 was best known for a workflow resembling the defunct 911 S5 service. Instead of receiving only a rotating gateway billed by traffic, customers bought IP credits and installed a desktop proxy manager. Inside the client they could filter residential addresses by country, city and internet service provider, choose an endpoint and forward it to a local port for a browser, automation tool or antidetect profile.
Historical documentation described SOCKS5 and HTTP(S) support, geographic filtering, pay-per-IP credits and sessions lasting up to roughly 12 hours. The provider advertised more than 200 million addresses in over 190 countries. Those were marketing claims, not independently audited capacity figures, and they do not describe any currently available network.
The 922 name was positioned to attract former 911 S5 customers after that service closed in 2022. This similarity does not establish that 922 legally inherited 911 or had the same operators. It describes the product design and audience, not proven corporate continuity.
On January 28, Google published a technical account of its action against IPIDEA. The named storefronts included 922 Proxy, PIA S5 Proxy, ABC Proxy, Cherry Proxy, 360 Proxy, IP2World, Luna Proxy, PY Proxy, Tab Proxy and several VPN brands.
GTIG found a shared pool of approximately 7,400 second-tier servers used to assign proxy tasks and relay traffic. It also identified more than 600 Android applications and 3,075 Windows files communicating with relevant infrastructure. Some applications contained SDKs that turned devices into residential exit nodes without sufficiently clear disclosure. Other users may have knowingly installed bandwidth-sharing software.
It would therefore be inaccurate to claim that every 922 IP came from an infected device. The verified issue is that deceptive and trojanized sourcing existed inside the shared supply chain and was substantial enough to trigger legal, platform and security action.
During one seven-day period, Google observed more than 550 tracked threat groups using IPIDEA exit addresses. That does not make every 922 customer malicious; residential proxies also have legitimate uses. It does show why opaque sourcing and shared control became a serious security and compliance problem.
Google pursued control and marketing domains, shared indicators with researchers and law enforcement, and expanded Google Play Protect enforcement against applications containing identified IPIDEA components. The action seriously damaged the network, but Google did not announce arrests or claim that every connected legal entity had been permanently dissolved.
922, PIA, ABC and Cherry had different websites, pricing and product mixes. They were not simply four names for one dashboard. However, Google's evidence showed common control and overlapping infrastructure behind them.
922 focused on client-managed, pay-per-IP residential SOCKS5 access. PIA used a similar manager while also selling static and longer-lived ISP products. ABC advertised a wider combination of rotating, static, unlimited and API products. Cherry marketed traffic-based and per-IP residential plans.
For customers, the lesson is practical: buying from several storefronts does not create a backup if all of them depend on the same upstream network.
922proxy.app presents itself as a direct continuation operated by part of the former team and claims access to the same residential pool. Those statements are self-published. No Google report, court record or independent technical investigation reviewed for this article verifies its ownership, team or network continuity.
Its own history also refers to piaproxy.com as though it were the original 922 domain, while Google identified that address as PIA S5 Proxy and listed 922proxy.com separately. The inconsistency does not by itself prove fraud, but it prevents us from calling the site an official successor.
Do not download old 922 installers from mirrors, file-sharing sites, Telegram posts or search ads. A copied logo and familiar interface do not authenticate an executable.
Remove old endpoints from browsers, antidetect profiles, scripts, servers and scheduled jobs. Revoke proxy credentials and API tokens, and change any password reused on another service. Check CI variables, shared team documents and password managers for forgotten credentials.
Review important accounts for unfamiliar sessions, security prompts and source-IP changes. Organizations should compare network logs with the indicators published by Google and preserve suspicious installers for internal security analysis.
If you installed free VPN, bandwidth-sharing or “earn with your internet” applications, run current security scans and keep Google Play Protect enabled. Update routers and IoT devices, disable unnecessary remote administration and isolate equipment showing unexplained traffic.
Be cautious with balance-migration offers. Sending an unknown operator an old invoice, username or payment record exposes information without proving that the operator can restore anything.
Ask who legally operates the service, how device owners consent to become exit nodes, whether upstream networks and resellers are disclosed, how users can opt out, and how abuse reports are handled. Request evidence rather than accepting “ethical sourcing” as a slogan. Start with a small paid test and verify protocol support, location accuracy, session duration, success rate and refund terms.
Commercial disclosure: ProxyUniverse is a partner of this publication and offers residential, mobile and dedicated IPv4 products from multiple suppliers. This mention is not an independent audit of every upstream pool. Apply the same due-diligence questions to the exact product you select.
For a separate current incident, see our 9Proxy outage and recovery report.
The original service at 922proxy.com is unavailable and its domain is under clientHold. It should be treated as shut down.
Google disrupted the shared IPIDEA infrastructure and named 922 as a controlled brand. It did not claim that every component was permanently destroyed.
The published evidence says the actors behind IPIDEA controlled 922. It does not establish a formal parent-subsidiary structure.
The site says it is a continuation, but that claim has not been independently verified.
Dolphin Anty, AdsPower, GoLogin, and Multilogin compared by workflow, team use, and proxy setup — without mixing browser tools into proxy rankings.
NewsCherry Proxy's website and retail service appear unavailable. We separate storefront status from the partial recovery of underlying IPIDEA infrastructure.
NewsABCProxy's original domain is currently sinkholed after the IPIDEA disruption. Indexed pages may remain visible, but normal service cannot be verified.
