Is IP2World Down? Verified 2026 Status After IPIDEA

Updated July 12, 2026: In our checks, ip2world.com does not resolve in public DNS and the service cannot be reached. Google named IP2World among the brands controlled by the actors behind IPIDEA. The accurate summary: IP2World was materially disrupted and its original site is unavailable — which is different from proof that every server and IP was permanently destroyed.

Keep three layers separate when someone asks "is IP2World still working?":

• Website: ip2world.com returns no DNS answer in our tests; the storefront, dashboard and docs do not load.
• Retail service: login, credit top-ups, the S5 client, endpoint generation, renewals and support cannot be verified through the original domain.
• Backend network: Google seriously degraded the shared IPIDEA pool, but later independent telemetry showed that much of that supply survived, went dormant, or moved through other resale channels.

For any production task, treat IP2World as unavailable and unsuitable. That is more defensible than "the company was permanently liquidated," which the public record does not establish.

Source: Google Threat Intelligence Group, captured by ProxyRadar. The detailed claims live in the linked original report.

What IP2World was known for#

IP2World built its reputation on cheap, credit-based access. Its published catalog centered on a Windows S5 proxy client: customers bought IP credits, then filtered residential addresses by country, state, city and ISP inside the client and forwarded a chosen exit to a local port for a browser, scraper or antidetect profile. It also advertised rotating residential proxies billed by traffic, static residential/ISP addresses, "unlimited traffic" plans and an API.

Marketing claimed a pool commonly cited at 90 million+ residential IPs across 220+ regions. These were vendor claims, not independently audited figures, and they describe a network that is no longer reachable through the original brand. They cannot be treated as current capacity.

The per-IP S5 model made IP2World popular with users migrating away from the defunct 911 S5 service — a design similarity, not proof of shared ownership with 911.

Why Google named IP2World#

On January 28, 2026, Google Threat Intelligence Group (GTIG) published its investigation into IPIDEA and said many ostensibly independent providers were controlled by the same actors. The named list explicitly included IP2World (ip2world.com) alongside 360 Proxy, 922 Proxy, ABC Proxy, Cherry Proxy, Luna Proxy, PIA S5 Proxy, PY Proxy, Tab Proxy and several VPN and SDK brands.

According to GTIG, SDKs embedded in mobile and desktop apps recruited residential exit nodes, and some apps did not clearly disclose that the user's device and home IP would join a commercial proxy network. Across the ecosystem, Google documented more than 600 Android apps, roughly 3,075 Windows files and about 7,400 second-tier command-and-control servers, and observed more than 550 tracked threat groups using IPIDEA exits in a single seven-day window.

These are network-wide figures. They do not prove every IP2World customer or IP was malicious, but they explain why legal, platform and security action followed. Google described the result as significant degradation and a device pool reduced by millions — disruption, not a claim that the brand can never reappear. Reuters, BleepingComputer and others reported the same framing, and Proxyway's 2026 market research lists ip2world.com in its "shut down" column.

The NetNut takedown and what it means for IP2World#

On July 2, 2026, Google, the FBI and Lumen announced action against the NetNut residential proxy network ("Popa"). Google stated it has "high confidence that many popular residential proxy brands are in fact whitelabeling the NetNut botnet" and warned that disrupted operators often start reselling competitors' capacity.

State this precisely: the NetNut post did not publish a new list re-attributing IP2World specifically to NetNut. What is confirmed is that IP2World was named in the January IPIDEA action, and that the ecosystem shares pools heavily — IPinfo research found roughly nine in ten IPIDEA IPs also appeared in other providers. So a dead IP2World storefront does not mean "IP2World IPs" disappeared from the market; they may be resold elsewhere.

What can be verified now#

• ip2world.com does not resolve in our DNS checks; the site does not load.
• Google explicitly named IP2World in the January 2026 IPIDEA disruption.
• Independent trackers list ip2world.com among shut-down IPIDEA brands.
• No verified IP2World announcement of permanent closure and no confirmed refund program were found.

IP2World's website and retail service are unavailable after the IPIDEA disruption, and its original domain no longer resolves. There is no verified permanent-shutdown notice, and part of the pool may persist via resellers — which does not restore IP2World's service.

What former IP2World customers should do#

Do not buy more credits, pay an "unlock" fee, or reinstall the IP2World S5 client from a mirror, Telegram link or ad. After a domain disappears, look-alike sites and reuploaded clients are prime phishing and malware vectors.

1. Rotate any reused password; revoke IP2World credentials and API keys stored in browsers, antidetect profiles, scripts, CI secrets and servers.
2. Review important accounts for unfamiliar sessions and source-IP changes after the outage began.
3. If the S5 client is still installed, quarantine or remove it, check startup entries and scheduled tasks, and run an updated scan. Precautionary, not proof that every build was malicious.
4. For a refund, preserve invoices and support messages, send one documented request to the last verified contact, and ask your card issuer or PayPal about dispute deadlines. Crypto payments normally have no chargeback.

Choosing a safer replacement#

A large advertised pool and a low per-IP price do not prove informed consent from the device owners routing your traffic. Ask who legally operates the service, how device owners opt in and out, whether upstream suppliers and resellers are disclosed, and how abuse is handled. Treat "ethical," "clean" and "compliant" as marketing until backed by a DPA and auditable procedures, then run a small paid test measuring success rate, latency, geolocation accuracy, CAPTCHA rate, session stability and support.

For related incidents, see our reports on PIA S5 Proxy, 922 Proxy, ABCProxy and Cherry Proxy, plus the 9Proxy outage report.

Commercial disclosure: ProxyUniverse is one partner option available through this publication. This mention is not an independent audit of its IP sourcing or compliance. Apply the same consent, ownership and performance checks and compare other providers before purchasing.

FAQ#

Is IP2World shut down for good?#

Its website is unavailable and its domain does not resolve, and Google named it in the IPIDEA disruption. No verified announcement confirms permanent corporate closure, so "currently unavailable and disrupted" is accurate.

Was every IP2World S5 IP from an infected device?#

Not established. Google documented substantial trojanized and deceptive sourcing across the shared IPIDEA supply chain, not universal maliciousness of every IP.

Is IP2World part of the NetNut botnet?#

IP2World was named in the January IPIDEA action. Google's July NetNut post warns "many" brands whitelabel NetNut but did not specifically re-attribute IP2World. Treat that specific claim as unconfirmed.

Can I recover my credits or balance?#

There is no confirmed general refund program. Preserve evidence and promptly ask your payment provider about dispute options.

Sources#

• GTIG: Disrupting the World's Largest Residential Proxy Network
• GTIG: Google's Continued Disruption of Malicious Residential Proxy Networks (NetNut)
• Reuters: Google disrupts large residential proxy network
• BleepingComputer: Google disrupts IPIDEA residential proxy networks
• KrebsOnSecurity: FBI Seizes NetNut Proxy Platform, Popa Botnet
• Proxyway: Google Disrupts 10+ IPIDEA-Related Providers
• IPinfo: Residential Proxy Infrastructure Research