Aisuru<\/strong>, the botnet responsible for a series of record-smashing distributed denial-of-service (DDoS) attacks this year, recently was overhauled to support a more low-key, lucrative and sustainable business: Renting hundreds of thousands of infected Internet of Things (IoT) devices to proxy services that help cybercriminals anonymize their traffic. Experts say a glut of proxies from Aisuru and other sources is fueling large-scale data harvesting efforts tied to various artificial intelligence (AI) projects, helping content scrapers evade detection by routing their traffic through residential connections that appear to be regular Internet users.<\/p>\n First identified in August 2024, Aisuru has spread to at least 700,000 IoT systems, such as poorly secured Internet routers and security cameras. Aisuru\u2019s overlords have used their massive botnet to clobber targets with headline-grabbing DDoS attacks, flooding targeted hosts with blasts of junk requests from all infected systems simultaneously.<\/p>\n In June, Aisuru hit KrebsOnSecurity.com with a DDoS clocking at 6.3 terabits per second<\/a> \u2014 the biggest attack that Google<\/strong> had ever mitigated at the time. In the weeks and months that followed, Aisuru\u2019s operators demonstrated DDoS capabilities of nearly 30 terabits of data per second \u2014 well beyond the attack mitigation capabilities of most Internet destinations.<\/p>\n These digital sieges have been particularly disruptive this year for U.S.-based Internet service providers (ISPs), in part because Aisuru recently succeeded in taking over a large number of IoT devices in the United States<\/a>. And when Aisuru launches attacks, the volume of outgoing traffic from infected systems on these ISPs is often so high that it can disrupt or degrade Internet service for adjacent (non-botted) customers of the ISPs.<\/p>\n \u201cMultiple broadband access network operators have experienced significant operational impact due to outbound DDoS attacks in excess of 1.5Tb\/sec launched from Aisuru botnet nodes residing on end-customer premises,\u201d wrote Roland Dobbins<\/strong>, principal engineer at Netscout<\/strong>, in a recent executive summary on Aisuru<\/a>. \u201cOutbound\/crossbound attack traffic exceeding 1Tb\/sec from compromised customer premise equipment (CPE) devices has caused significant disruption to wireline and wireless broadband access networks. High-throughput attacks have caused chassis-based router line card failures.\u201d<\/p>\n The incessant attacks from Aisuru have caught the attention of federal authorities in the United States and Europe (many of Aisuru\u2019s victims are customers of ISPs and hosting providers based in Europe). Quite recently, some of the world\u2019s largest ISPs have started informally sharing block lists identifying the rapidly shifting locations of the servers that the attackers use to control the activities of the botnet.<\/p>\n Experts say the Aisuru botmasters recently updated their malware so that compromised devices can more easily be rented to so-called \u201cresidential proxy<\/strong>\u201d providers. These proxy services allow paying customers to route their Internet communications through someone else\u2019s device, providing anonymity and the ability to appear as a regular Internet user in almost any major city worldwide.<\/p>\n From a website\u2019s perspective, the IP traffic of a residential proxy network user appears to originate from the rented residential IP address, not from the proxy service customer. Proxy services can be used in a legitimate manner for several business purposes \u2014 such as price comparisons or sales intelligence. But they are massively abused for hiding cybercrime activity (think advertising fraud, credential stuffing) because they can make it difficult to trace malicious traffic to its original source.<\/p>\n And as we\u2019ll see in a moment, this entire shadowy industry appears to be shifting its focus toward enabling aggressive content scraping activity that continuously feeds raw data into large language models (LLMs) built to support various AI projects.<\/p>\n Riley Kilmer<\/strong> is co-founder of spur.us<\/a>, a service that tracks proxy networks. Kilmer said all of the top proxy services have grown exponentially over the past six months \u2014 with some adding between 10 to 200 times more proxies for rent.<\/p>\n \u201cI just checked, and in the last 90 days we\u2019ve seen 250 million unique residential proxy IPs,\u201d Kilmer said. \u201cThat is insane. That is so high of a number, it\u2019s unheard of. These proxies are absolutely everywhere now.\u201d<\/p>\n To put Kilmer\u2019s comments in perspective, here was Spur\u2019s view of the Top 10 proxy networks by approximate install base, circa May 2025:<\/p>\n AUPROXIES_PROXY\u00a0 66,097 Today, Spur says it is tracking an unprecedented spike in available proxies across all providers, including;<\/p>\n LUMINATI_PROXY\u00a0 \u00a0 11,856,421 Reached for comment about the apparent rapid growth in their proxy network, Oxylabs (#4 on Spur\u2019s list) said while their proxy pool did grow recently, it did so at nowhere near the rate cited by Spur.<\/p>\n \u201cWe don\u2019t systematically track other providers\u2019 figures, and we\u2019re not aware of any instances of 10\u00d7 or 100\u00d7 growth, especially when it comes to a few bigger companies that are legitimate businesses,\u201d the company said in a written statement.<\/p>\n Bright Data<\/strong> was formerly known as Luminati Networks<\/strong>, the name that is currently at the top of Spur\u2019s list of the biggest residential proxy networks, with more than 11 million proxies. Bright Data likewise told KrebsOnSecurity that Spur\u2019s current estimates of its proxy network are dramatically overstated and inaccurate.<\/p>\n \u201cWe did not actively initiate nor do we see any 10x or 100x expansion of our network, which leads me to believe that someone might be presenting these IPs as Bright Data\u2019s in some way,\u201d said Rony Shalit<\/strong>, Bright Data\u2019s chief compliance and ethics officer. \u201cIn many cases in the past, due to us being the leading data collection proxy provider, IPs were falsely tagged as being part of our network, or while being used by other proxy providers for malicious activity.\u201d<\/p>\n \u201cOur network is only sourced from verified IP providers and a robust opt-in only residential peers<\/a>, which we work hard and in complete transparency to obtain,\u201d Shalit continued. \u201cEvery DC, ISP or SDK partner is reviewed and approved, and every residential peer must actively opt in to be part of our network.\u201d<\/p>\n Even Spur acknowledges that Luminati and Oxylabs are unlike most other proxy services on their top proxy providers list, in that these providers actually adhere to \u201cknow-your-customer\u201d policies, such as requiring video calls with all customers, and strictly blocking customers from reselling access.<\/p>\n Benjamin Brundage<\/strong> is founder of Synthient<\/a>, a startup that helps companies detect proxy networks. Brundage said if there is increasing confusion around which proxy networks are the most worrisome, it\u2019s because nearly all of these lesser-known proxy services have evolved into highly incestuous bandwidth resellers. What\u2019s more, he said, some proxy providers do not appreciate being tracked and have been known to take aggressive steps to confuse systems that scan the Internet for residential proxy nodes.<\/p>\n Brundage said most proxy services today have created their own software development kit<\/strong> or SDK that other app developers can bundle with their code to earn revenue. These SDKs quietly modify the user\u2019s device so that some portion of their bandwidth can be used to forward traffic from proxy service customers.<\/p>\n \u201cProxy providers have pools of constantly churning IP addresses,\u201d he said. \u201cThese IP addresses are sourced through various means, such as bandwidth-sharing apps, botnets, Android SDKs, and more. These providers will often either directly approach resellers or offer a reseller program that allows users to resell bandwidth through their platform.\u201d<\/p>\n Many SDK providers say they require full consent before allowing their software to be installed on end-user devices. Still, those opt-in agreements and consent checkboxes may be little more than a formality for cybercriminals like the Aisuru botmasters, who can earn a commission each time one of their infected devices is forced to install<\/em> some SDK that enables one or more of these proxy services.<\/p>\n Depending on its structure, a single provider may operate hundreds of different proxy pools at a time \u2014 all maintained through other means, Brundage said.<\/p>\n \u201cOften, you\u2019ll see resellers maintaining their own proxy pool in addition to an upstream provider,\u201d he said. \u201cIt allows them to market a proxy pool to high-value clients and offer an unlimited bandwidth plan for cheap reduce their own costs.\u201d<\/p>\n Some proxy providers appear to be directly in league with botmasters. Brundage identified one proxy provider that was aggressively advertising cheap and plentiful bandwidth to content scraping companies. After scanning that provider\u2019s pool of available proxies, Brundage said he found a one-to-one match with IP addresses he\u2019d previously mapped to the Aisuru botnet.<\/p>\n Brundage says that by almost any measurement, the world\u2019s largest residential proxy service is IPidea<\/strong>, a China-based proxy network. IPidea is #5 on Spur\u2019s Top 10, and Brundage said its brands include ABCProxy <\/strong>(#3), Roxlabs<\/strong>, LunaProxy<\/strong>, PIA S5 Proxy<\/strong>, PyProxy<\/strong>, 922Proxy<\/strong>, 360Proxy<\/strong>, IP2World<\/strong>, and Cherry Proxy.\u00a0<\/strong>Spur\u2019s Kilmer said they also track Yilu Proxy\u00a0<\/strong>(#10) as IPidea.<\/p>\n Brundage said all of these providers operate under a corporate umbrella known on the cybercrime forums as \u201cHK Network<\/strong>.\u201d<\/p>\n \u201cThe way it works is there\u2019s this whole reseller ecosystem, where IPidea will be incredibly aggressive and approach all these proxy providers with the offer, \u2018Hey, if you guys buy bandwidth from us, we\u2019ll give you these amazing reseller prices,’\u201d Brundage explained. \u201cBut they\u2019re also very aggressive in recruiting resellers for their apps.\u201d<\/p>\n A graphic depicting the relationship between proxy providers that Synthient found are white labeling IPidea proxies. Image: Synthient.com.<\/p>\n<\/div>\n Those apps include a range of low-cost and \u201cfree\u201d virtual private networking (VPN) services that indeed allow users to enjoy a free VPN, but which also turn the user\u2019s device into a traffic relay that can be rented to cybercriminals, or else parceled out to countless other proxy networks.<\/p>\n \u201cThey have all this bandwidth to offload,\u201d Brundage said of IPidea and its sister networks. \u201cAnd they can do it through their own platforms, or they go get resellers to do it for them by advertising on sketchy hacker forums to reach more people.\u201d<\/p>\n One of IPidea\u2019s core brands is 922S5Proxy<\/strong>, which is a not-so-subtle nod to the 911S5Proxy<\/strong> service that was hugely popular between 2015 and 2022. In July 2022, KrebsOnSecurity published a deep dive into 911S5Proxy\u2019s origins and apparent owners in China<\/a>. Less than a week later, 911S5Proxy announced it was closing down after the company\u2019s servers were massively hacked<\/a>.<\/p>\n That 2022 story named Yunhe Wang<\/strong> from Beijing as the apparent owner and\/or manager of the 911S5 proxy service. In May 2024, the U.S. Department of Justice<\/strong> arrested Mr Wang<\/a>, alleging that his network was used to steal billions of dollars from financial institutions, credit card issuers, and federal lending programs. At the same time, the U.S. Treasury Department announced sanctions against Wang and two other Chinese nationals for operating 911S5Proxy.<\/p>\n The website for 922Proxy.<\/p>\n<\/div>\n In recent months, multiple experts who track botnet and proxy activity have shared that a great deal of content scraping which ultimate benefits AI companies is now leveraging these proxy networks to further obfuscate their aggressive data-slurping activity. That\u2019s because by routing it through residential IP addresses, content scraping firms can make their traffic far trickier to filter out.<\/p>\n \u201cIt\u2019s really difficult to block, because there\u2019s a risk of blocking real people,\u201d Spur\u2019s Kilmer said of the LLM scraping activity that is fed through individual residential IP addresses, which are often shared by multiple customers at once.<\/p>\n Kilmer says the AI industry has brought a veneer of legitimacy to residential proxy business, which has heretofore mostly been associated with sketchy affiliate money making programs, automated abuse, and unwanted Internet traffic.<\/p>\n \u201cWeb crawling and scraping has always been a thing, but AI made it like a commodity, data that had to be collected,\u201d Kilmer said.<\/span> \u201cEverybody wanted to monetize their own data pots, and how they monetize that is different across the board.\u201d<\/p>\n Kilmer said many LLM-related scrapers rely on residential proxies in cases where the content provider has restricted access to their platform in some way, such as forcing interaction through an app, or keeping all content behind a login page with multi-factor authentication.<\/p>\n \u201cWhere the cost of data is out of reach \u2014 there is some exclusivity or reason they can\u2019t access the data \u2014 they\u2019ll turn to residential proxies so they look like a real person accessing that data,\u201d Kilmer said of the content scraping efforts.<\/p>\n Aggressive AI crawlers increasingly are overloading community-maintained infrastructure<\/a>, causing what amounts to persistent DDoS attacks on vital public resources. A report<\/a> earlier this year from LibreNews<\/strong> found some open-source projects now see as much as 97 percent of their traffic originating from AI company bots, dramatically increasing bandwidth costs, service instability, and burdening already stretched-thin maintainers.<\/p>\n Cloudflare<\/strong> is now experimenting with tools that will allow content creators to charge a fee to AI crawlers to scrape their websites. The company\u2019s \u201cpay-per-crawl<\/a>\u201d feature is currently in a private beta, but it lets publishers set their own prices that bots must pay before scraping content.<\/p>\n On October 22, the social media and news network Reddit<\/strong> sued Oxylabs (PDF)<\/a> and several other proxy providers, alleging that their systems enabled the mass-scraping of Reddit user content even though Reddit had taken steps to block such activity.<\/p>\n \u201cRecognizing that Reddit denies scrapers like them access to its site, Defendants scrape the data from Google\u2019s search results instead,\u201d the lawsuit alleges. \u201cThey do so by masking their identities, hiding their locations, and disguising their web scrapers as regular people (among other techniques) to circumvent or bypass the security restrictions meant to stop them.\u201d<\/p>\n Denas Grybauskas<\/strong>, chief governance and strategy officer at Oxylabs, said the company was shocked and disappointed by the lawsuit.<\/p>\n \u201cReddit has made no attempt to speak with us directly or communicate any potential concerns,\u201d Grybauskas said in a written statement. \u201cOxylabs has always been and will continue to be a pioneer and an industry leader in public data collection, and it will not hesitate to defend itself against these allegations. Oxylabs\u2019 position is that no company should claim ownership of public data that does not belong to them. It is possible that it is just an attempt to sell the same public data at an inflated price.\u201d<\/p>\n As big and powerful as Aisuru may be, it is hardly the only botnet that is contributing to the overall broad availability of residential proxies. For example, on June 5 the FBI\u2019s Internet Crime Complaint Center<\/strong> warned<\/a> that an IoT malware threat dubbed BADBOX 2.0<\/a> had compromised millions of smart-TV boxes, digital projectors, vehicle infotainment units, picture frames, and other IoT devices.<\/p>\n In July 2025, Google filed a lawsuit<\/a> in New York federal court against the Badbox botnet\u2019s alleged perpetrators. Google said the Badbox 2.0 botnet \u201ccompromised more than 10 million uncertified devices running Android\u2019s open-source software, which lacks Google\u2019s security protections. Cybercriminals infected these devices with pre-installed malware and exploited them to conduct large-scale ad fraud and other digital crimes.\u201d<\/p>\n Brundage said the Aisuru botmasters have their own SDK, and for some reason part of its code tells many newly-infected systems to query the domain name fuckbriankrebs[.]com<\/strong>. This may be little more than an elaborate \u201cscrew you\u201d to this site\u2019s author: One of the botnet\u2019s alleged partners goes by the handle \u201cForky<\/strong>,\u201d and was identified in June by KrebsOnSecurity as a young man from Sao Paulo, Brazil<\/a>.<\/p>\n Brundage noted that only systems infected with Aisuru\u2019s Android SDK will be forced to resolve the domain. Initially, there was some discussion about whether the domain might have some utility as a \u201ckill switch\u201d capable of disrupting the botnet\u2019s operations, although Brundage and others interviewed for this story say that is unlikely.<\/p>\n A tiny sample of the traffic after a DNS server was enabled on the newly registered domain fuckbriankrebs dot com. Each unique IP address requested its own unique subdomain. Image: Seralys.<\/p>\n<\/div>\n For one thing, they said, if the domain was somehow critical to the operation of the botnet, why was it still unregistered and actively for-sale? Why indeed, we asked. Happily, the domain name was deftly snatched up last week by Philippe Caturegli<\/strong>, \u201cchief hacking officer\u201d for the security intelligence company Seralys<\/a>.<\/p>\n Caturegli enabled a passive DNS server on that domain and within a few hours received more than 700,000 requests for unique subdomains on fuckbriankrebs[.]com<\/a>.<\/p>\n But even with that visibility into Aisuru, it is difficult to use this domain check-in feature to measure its true size, Brundage said. After all, he said, the systems that are phoning home to the domain are only a small portion of the overall botnet.<\/p>\n \u201cThe bots are hardcoded to just spam lookups on the subdomains,\u201d he said. \u201cSo anytime an infection occurs or it runs in the background, it will do one of those DNS queries.\u201d<\/p>\n Caturegli briefly configured all subdomains on fuckbriankrebs dot com to display this ASCII art image to visiting systems today.<\/p>\n<\/div>\n The domain fuckbriankrebs[.]com has a storied history. On its initial launch in 2009, it was used to spread malicious software by the <\/a>Cutwail<\/a> spam botnet<\/a>. In 2011, the domain was involved in a notable DDoS against this website from a botnet powered by Russkill<\/strong> (a.k.a. \u201cDirt Jumper\u201d).<\/p>\n Domaintools.com<\/strong> finds that in 2015, fuckbriankrebs[.]com was registered to an email address attributed to David \u201cAbdilo\u201d Crees<\/strong>, a 27-year-old Australian man sentenced in May 2025 to time served<\/a> for cybercrime convictions related to the Lizard Squad hacking group<\/a>.<\/p>\n<\/div>\n![\"Image](\"https:\/\/i0.wp.com\/krebsonsecurity.com\/wp-content\/uploads\/2025\/10\/aisuru-ipidea.png?resize=749%2C415&ssl=1\")
<\/p>\n![\"\"](\"https:\/\/i0.wp.com\/krebsonsecurity.com\/wp-content\/uploads\/2015\/06\/proxy.png?resize=631%2C264&ssl=1\")
<\/p>\n\u2018INSANE\u2019 GROWTH<\/h2>\n
\nRAYOBYTE_PROXY\u00a0 \u00a0 43,894
\nOXYLABS_PROXY\u00a0 \u00a043,008
\nWEBSHARE_PROXY\u00a0 \u00a039,800
\nIPROYAL_PROXY\u00a0 \u00a0 32,723
\nPROXYCHEAP_PROXY\u00a0 \u00a0 26,368
\nIPIDEA_PROXY\u00a0 \u00a0 26,202
\nMYPRIVATEPROXY_PROXY\u00a0 25,287
\nHYPE_PROXY\u00a0 \u00a0 18,185
\nMASSIVE_PROXY\u00a0 \u00a0 17,152<\/p>\n
\nNETNUT_PROXY\u00a0 \u00a0 10,982,458
\nABCPROXY_PROXY\u00a0 \u00a0 9,294,419
\nOXYLABS_PROXY\u00a0 \u00a0 \u00a06,754,790
\nIPIDEA_PROXY\u00a0 \u00a0 \u00a03,209,313
\nEARNFM_PROXY\u00a0 \u00a0 2,659,913
\nNODEMAVEN_PROXY\u00a0 \u00a0 2,627,851
\nINFATICA_PROXY\u00a0 \u00a0 2,335,194
\nIPROYAL_PROXY\u00a0 \u00a0 2,032,027
\nYILU_PROXY\u00a0 \u00a0 1,549,155<\/span><\/p>\nHK NETWORK<\/h2>\n
![\"\"](\"https:\/\/i0.wp.com\/krebsonsecurity.com\/wp-content\/uploads\/2025\/10\/synthient-hknetwork.png?resize=750%2C517&ssl=1\")
<\/a><\/p>\n![\"\"](\"https:\/\/i0.wp.com\/krebsonsecurity.com\/wp-content\/uploads\/2025\/10\/922proxy.png?resize=749%2C494&ssl=1\")
<\/p>\nDATA SCRAPING FOR AI<\/h2>\n
A FAMILIAR DOMAIN NAME<\/h2>\n
![\"\"](\"https:\/\/i0.wp.com\/krebsonsecurity.com\/wp-content\/uploads\/2025\/10\/fbk-seralys-r.png?resize=735%2C707&ssl=1\")
<\/p>\n![\"\"](\"https:\/\/i0.wp.com\/krebsonsecurity.com\/wp-content\/uploads\/2025\/10\/cat-fbk.png?resize=748%2C800&ssl=1\")
<\/p>\n