On May 28–29, 2026, the Hague Police Unit Cybercrime Team, operating alongside the Netherlands' National Cyber Security Centre (NCSC-NL), dismantled the Asocks botnet — a criminal residential proxy service that had compromised at least 17 million consumer devices worldwide. Acting on a tip from an NCSC researcher, investigators located and seized multiple botnet servers from a Netherlands-based hosting provider, which subsequently took the remaining infrastructure offline after identifying its criminal use.
The Asocks service advertised itself openly as a "universal proxy service" with 7 million IP addresses across 150 locations, available for subscriptions starting at $5 per month. Criminal customers used the compromised device network to obscure attack traffic origins, launch DDoS attacks, send spam and phishing emails, conduct credential stuffing campaigns, and distribute malware — all routing through legitimate consumer IP addresses to evade detection.
The botnet enslaved computers, routers, tablets, smartphones, and IoT devices including smart security cameras — any poorly protected consumer device was a potential node. The infrastructure's 200 servers were all physically located within the Netherlands, which enabled Dutch authorities to take decisive seizure action without complex cross-jurisdiction coordination.
◈ Table of Contents
PHASE 1 — WHAT HAPPENED
TIMELINE- 1Tip-off: An NCSC-NL security researcher identified the Asocks infrastructure and reported it to the Netherlands' National Cyber Security Centre, which rapidly escalated it to the Hague Police Unit Cybercrime Team.
- 2Investigation: Police investigators identified 200 servers physically located within the Netherlands that formed the core command-and-control infrastructure for the botnet. All were hosted with a single Netherlands-based provider.
- 3Seizure (May 28, 2026): Cybercrime specialists seized multiple botnet servers from the hosting provider for forensic analysis.
- 4Provider Shutdown: After realising the infrastructure was being used for criminal purposes, the hosting provider independently took the remaining Asocks botnet servers offline.
- 5Announcement (May 29, 2026): Dutch Politie and NCSC-NL publicly announced the disruption, confirming the botnet's scale at 17+ million infected devices.
PHASE 2 — HOW ASOCKS OPERATED
RESIDENTIAL PROXY MODELAsocks operated as a "residential proxy service" — a category of criminal infrastructure that infects poorly secured consumer devices with malware and then rents access to those compromised devices as exit nodes for criminal internet traffic. Because traffic exits from a real residential IP address belonging to a real consumer's device, it is difficult to distinguish from legitimate user activity and bypasses most IP reputation-based blocking.
| Service Detail | Value |
|---|---|
| Advertised IP Pool | 7 million IP addresses |
| Claimed Locations | 150 countries |
| Advertised Clients | 100,000 subscribers |
| Pricing | $5–$15/month (discounts for bulk) |
| Proxy Types | Corporate, residential, and mobile proxies |
| Actual Scale | 17+ million compromised devices confirmed by Dutch police |
| Server Infrastructure | 200+ servers, all physically in the Netherlands |
| Device Types Compromised | Computers, tablets, smartphones, routers, smart cameras, IoT |
Asocks is one of several residential proxy botnet services operating in the criminal-as-a-service economy. Takedowns of individual services temporarily reduce available proxy inventory but do not eliminate demand. Expect replacement services within weeks.
PHASE 3 — CRIMINAL APPLICATIONS
ATTACK TYPESDDoS Attacks
Compromised residential devices launched volumetric denial-of-service attacks. Traffic originating from legitimate home IP addresses is far harder to rate-limit or block than traffic from known data-centre IP ranges.
Spam & Phishing
Email spam and phishing campaigns sent from residential IPs achieve higher inbox delivery rates. Major email providers' spam filters weight sender IP reputation heavily — residential IPs score significantly better than data-centre ranges.
Credential Stuffing
Automated login attacks against banks, e-commerce, and SaaS platforms routed through millions of different residential IPs evade rate limiting and IP-based account lockout defences entirely.
Malware Distribution
Malware download servers and command-and-control communications could route through residential proxies to avoid detection by network reputation systems that block data-centre IP ranges.
Click Fraud & SMS Pumping
Ad fraud and SMS pumping schemes used residential proxies to generate artificial engagement from geographically dispersed "real" user IPs, defeating fraud detection systems built on IP analysis.
Anonymisation for Threat Actors
Ransomware groups and state-sponsored actors used residential proxy services including Asocks as one layer of operational security to conceal their actual infrastructure during reconnaissance and initial access operations.
FIGURE 1 — Residential proxy botnet criminal use distribution (based on NCSC-NL advisory)
PHASE 4 — SCOPE & IMPACT
17M DEVICESAt 17 million compromised devices, Asocks represents one of the largest single botnet disruptions of 2026. For context: the FBI's 2024 disruption of the Qakbot botnet involved approximately 700,000 devices. Asocks is more than 24 times larger by device count. The 100,000 advertised subscribers — if accurate — means tens of thousands of criminal operations were relying on Asocks infrastructure simultaneously at any given time.
- 17 million+ compromised consumer devices globally
- 200 botnet C2 servers seized — all in the Netherlands
- Up to 100,000 criminal subscribers using the service
- Pricing as low as $5/month — democratised criminal proxy access
- Device types: PCs, routers, tablets, smartphones, smart cameras, IoT
- Complete takedown via single hosting provider relationship
The 17M device count almost certainly understates total infection. Asocks sold access to 7M IPs at any given time, but botnet operators typically maintain a pool larger than their active inventory to replace churned nodes. Many infected devices remain compromised even after C2 seizure until they are cleaned or reset.
PHASE 5 — DEFENSIVE TAKEAWAYS
ORGANISATIONS & CONSUMERS- 1Residential Proxy Evasion: If you are only blocking data-centre IP ranges, credential stuffing and account takeover attacks through residential proxies will bypass your controls. Deploy device fingerprinting and behavioural analytics alongside IP reputation scoring.
- 2Login Velocity Anomalies: Credential stuffing through diverse residential IPs avoids per-IP rate limits. Monitor for anomalous login success rate spikes across thousands of different IPs as a detection signal, not individual IP volume.
- 3DDoS Mitigation: Pure IP block-list defences are insufficient against residential botnets. Ensure volumetric DDoS mitigation includes challenge-response (CAPTCHA, JS challenge) mechanisms for web-facing services.
- 4Email Delivery Monitoring: Spam sent from residential IPs has elevated deliverability. Increase user education on phishing that bypasses spam filters due to residential sender IP reputation.
- 1Home Router Security: The majority of botnet recruitment happens through unpatched consumer routers with default or weak credentials. Change default passwords and enable automatic firmware updates on all home networking equipment.
- 2IoT Device Hygiene: Smart cameras, TVs, and other IoT devices are frequent botnet targets. Segment IoT devices onto a separate VLAN or guest network where they cannot interact with PCs and phones.
- 3Check Your IP: Compromised devices used as proxy exit nodes may have their IP addresses appear on threat intelligence block lists. If your home IP has been flagged, a full router factory reset and password change is advised.
PHASE 6 — SOURCES
PRIMARY SOURCESCheck if your infrastructure was targeted by Asocks-routed attacks. The CyberHawk IOC Scanner can cross-reference your logs against known residential proxy botnet indicators and blocked IP reputation feeds. If your authentication systems were seeing unusual distributed login attempts, Asocks may have been the delivery mechanism.
◈ Stay Connected
Follow CyberHawk Threat Intel for threat intelligence, deployment guides and hands-on SOC tooling content.
"They can't exploit you if you are the Exploit."