Is PYProxy Down? Verified 2026 Status After IPIDEA

Updated July 12, 2026: In our checks, pyproxy.com does not resolve in public DNS and the service cannot be reached. Google named PY Proxy among the brands controlled by the actors behind IPIDEA. The accurate summary: PYProxy was materially disrupted and its original site is unavailable — which is not the same as proof that every server and IP was permanently destroyed.

Three layers people conflate when asking "is PYProxy still working?":

• Website: pyproxy.com returns no DNS answer in our tests; the storefront, dashboard, API docs and sign-up do not load.
• Retail service: login, top-ups, endpoint and sub-user generation, renewals and support cannot be verified through the original domain.
• Backend network: Google seriously degraded the shared IPIDEA pool, but later independent telemetry showed much of that supply survived, went dormant, or shifted through other resale channels.

For production, treat PYProxy as unavailable and unsuitable. That is more defensible than "the company was permanently liquidated," which the public record does not establish.

Source: Google Threat Intelligence Group, captured by ProxyRadar. The detailed claims live in the linked original report.

What PYProxy offered#

PYProxy positioned itself as a developer-friendly residential provider. Its published catalog advertised rotating residential proxies billed by traffic, static residential and ISP addresses, a per-IP SOCKS5 product, datacenter options, sub-user/sub-account management and an API for integration into scrapers and automation stacks, with HTTP(S) and SOCKS5 support and country/city/ISP targeting.

Marketing claimed a pool commonly cited around 90 million+ residential IPs across 190+ countries. These were vendor claims, not independently audited, and they describe a network no longer reachable through the original brand. They cannot be treated as current capacity. Independent comparison sites (for example ProxyCorner) now label PYProxy's service status as "Shut Down… following law enforcement action."

Why Google named PY Proxy#

On January 28, 2026, Google Threat Intelligence Group (GTIG) published its investigation into IPIDEA and stated that many ostensibly independent providers were controlled by the same actors. The named list explicitly included PY Proxy (pyproxy.com) alongside 360 Proxy, 922 Proxy, ABC Proxy, Cherry Proxy, IP2World, Luna Proxy, PIA S5 Proxy, Tab Proxy and several VPN and SDK brands.

According to GTIG, SDKs embedded in mobile and desktop apps recruited residential exit nodes, and some apps did not clearly disclose that a user's device and home IP would join a commercial proxy network. Across the ecosystem, Google documented more than 600 Android apps, roughly 3,075 Windows files and about 7,400 second-tier command-and-control servers, and observed more than 550 tracked threat groups using IPIDEA exits in a single seven-day window.

These are network-wide figures. They do not prove every PYProxy customer or IP was malicious, but they explain the legal, platform and security action that followed. Google described the result as significant degradation and a device pool reduced by millions — disruption, not a claim the brand can never return. Proxyway's 2026 market research lists pyproxy.com in its "shut down" column.

The NetNut takedown and what it means for PYProxy#

On July 2, 2026, Google, the FBI and Lumen announced action against the NetNut residential proxy network ("Popa"). Google stated it has "high confidence that many popular residential proxy brands are in fact whitelabeling the NetNut botnet" and warned that disrupted operators often start reselling competitors' capacity.

Be precise: the NetNut post did not publish a new list re-attributing PYProxy specifically to NetNut. What is confirmed is that PYProxy was named in the January IPIDEA action and that the ecosystem shares pools heavily — IPinfo found roughly nine in ten IPIDEA IPs also appeared in other providers. A dead PYProxy storefront does not mean "PYProxy IPs" left the market; that capacity may be resold elsewhere.

What can be verified now#

• pyproxy.com does not resolve in our DNS checks; the site does not load.
• Google explicitly named PY Proxy in the January 2026 IPIDEA disruption.
• Independent trackers list pyproxy.com among shut-down IPIDEA brands.
• No verified PYProxy announcement of permanent closure and no confirmed refund program were found.

PYProxy's website and retail service are unavailable after the IPIDEA disruption, and its original domain no longer resolves. There is no verified permanent-shutdown notice, and part of the pool may persist via resellers — which does not restore PYProxy's service.

What former PYProxy customers and developers should do#

Do not top up an old balance, pay an "unlock" fee, or reinstall PYProxy tooling from a mirror, Telegram link or ad. After a domain disappears, look-alike sites and reuploaded clients are prime phishing and malware vectors.

1. Rotate any reused password; revoke PYProxy credentials, sub-user logins and API keys stored in browsers, antidetect profiles, scripts, CI secrets, Docker images and servers. Developers frequently hardcode proxy credentials in repos and pipelines — audit those now.
2. Review important accounts and target platforms for unfamiliar sessions and source-IP changes after the outage began.
3. If PYProxy software or a proxy manager is still installed, quarantine or remove it, check startup entries and scheduled tasks, and run an updated scan. Precautionary, not proof that every build was malicious.
4. For a refund, preserve invoices and support messages, send one documented request to the last verified contact, and ask your card issuer or PayPal about dispute deadlines. Crypto payments normally have no chargeback.

Choosing a safer replacement#

A large advertised pool and a low per-GB or per-IP price do not prove informed consent from the device owners routing your traffic. Ask who legally operates the service, how device owners opt in and out, whether upstream suppliers and resellers are disclosed, and how abuse is handled. Treat "ethical," "clean" and "compliant" as marketing until backed by a DPA and auditable procedures, then run a small paid test measuring success rate, latency, geolocation accuracy, CAPTCHA rate, session stability and support quality against your real targets.

For related incidents, see our reports on PIA S5 Proxy, 922 Proxy, ABCProxy and Cherry Proxy, plus the 9Proxy outage report.

Commercial disclosure: ProxyUniverse is one partner option available through this publication. This mention is not an independent audit of its IP sourcing or compliance. Apply the same consent, ownership and performance checks and compare other providers before purchasing.

FAQ#

Is PYProxy shut down for good?#

Its website is unavailable and its domain does not resolve, and Google named it in the IPIDEA disruption. No verified announcement confirms permanent corporate closure, so "currently unavailable and disrupted" is accurate.

Was every PYProxy IP from an infected device?#

Not established. Google documented substantial trojanized and deceptive sourcing across the shared IPIDEA supply chain, not universal maliciousness of every IP.

Is PYProxy part of the NetNut botnet?#

PYProxy was named in the January IPIDEA action. Google's July NetNut post warns "many" brands whitelabel NetNut but did not specifically re-attribute PYProxy. Treat that specific claim as unconfirmed.

Can I recover my balance?#

There is no confirmed general refund program. Preserve evidence and promptly ask your payment provider about dispute options.

Sources#

• GTIG: Disrupting the World's Largest Residential Proxy Network
• GTIG: Google's Continued Disruption of Malicious Residential Proxy Networks (NetNut)
• Reuters: Google disrupts large residential proxy network
• BleepingComputer: Google disrupts IPIDEA residential proxy networks
• KrebsOnSecurity: FBI Seizes NetNut Proxy Platform, Popa Botnet
• Proxyway: Google Disrupts 10+ IPIDEA-Related Providers
• IPinfo: Residential Proxy Infrastructure Research