The DOJ and Europol just took down SocksEscort. A residential proxy network that has been running since 2009.
The Webpage now displays a seizure banner: https://socksescort.com/login
The network had hijacked 369,000 devices across 163 countries. Routers, IoT devices, residential IPs. All were infected with AVRecon malware and rented out to criminals who needed clean addresses to bypass fraud detection at banks and crypto exchanges.
20,000 new devices are infected every week since early 2024. Total revenue is estimated at $5.8 million over the life of the operation. One victim in New York lost roughly $1 million in crypto alone after their account was hit through a SocksEscort proxy.
The FBI have said a wave of indictments will be coming down on some of the larger targets who had used the site.
