Google, along with partners, took action to disrupt the IPIDEA proxy network, a widespread residential proxy used for malicious activities. This involved legal action to take down controlling domains and sharing technical intelligence on the IPIDEA SDKs to promote ecosystem-wide awareness. Google Play Protect was updated to protect Android users, removing and blocking apps incorporating IPIDEA SDKs. Residential proxies mask malicious activity by routing traffic through consumer devices, which IPIDEA exploited by incorporating SDKs into apps, turning devices into exit nodes. The IPIDEA network facilitates various botnets and is used by numerous threat actors for espionage, cybercrime, and information operations. Devices participating in these proxies face risks such as being flagged and introducing security vulnerabilities to the user’s device. Several brands, like 360 Proxy and 922 Proxy, are associated with the IPIDEA network. The SDKs, marketed to developers for monetization, secretly enroll devices and offer compatibility with various operating systems. The proxy network utilizes a two-tier command-and-control system with Tier One domains directing devices to Tier Two servers for proxy tasks and data routing. This action by Google has significantly impacted IPIDEA's operations, reducing available devices by millions.