{"rid":"ip-proxy/lunaproxy-and-pia-s5","card":{"rid":"ip-proxy/lunaproxy-and-pia-s5","eid":"google","topic":"ip-proxy","slug":"lunaproxy-and-pia-s5","provider":"LunaProxy, PIA S5 Proxy and 911 S5 (911.re)","url":"https://cloud.google.com/blog/topics/threat-intelligence/disrupting-largest-residential-proxy-network","domain":"google.com","category":"residential/mobile proxy network","tier":"none","verdict":"dead","vorder":7,"grp":"dead","confidence":"documented","binding":"none","identity_kind":"anonymous","identity_basis":"stated","needs_card":0,"needs_phone":0,"needs_id":0,"needs_institution":0,"country":null,"crypto":null,"interfaces":null,"egress_metered":0,"per_object_bytes":null,"retention_days":null,"verified_at":"2026-10-24T10:07:11.000Z","verified_basis":"live","checked_on":"2026-10-25","stale_on":"2026-11-24","n_evidence":6,"usd_month":null,"usd_per_tb_month":null,"summary":"No live offer. lunaproxy.com and piaproxy.com return NXDOMAIN, and 911.re serves a seizure notice in place of a product page, all read 2026-10-24. Nothing wa...","duplicate_of":null,"n_unknown":3},"record":{"topic":"ip-proxy","slug":"lunaproxy-and-pia-s5","provider":"LunaProxy, PIA S5 Proxy and 911 S5 (911.re)","url":"https://cloud.google.com/blog/topics/threat-intelligence/disrupting-largest-residential-proxy-network","category":"residential/mobile proxy network","tier":"none","free_tier":{"stated":"No live offer. lunaproxy.com and piaproxy.com return NXDOMAIN, and 911.re serves a seizure notice in place of a product page, all read 2026-10-24. Nothing was priced because nothing answers.","unit":"none","metered_on":"none","source_url":"https://cloud.google.com/blog/topics/threat-intelligence/disrupting-largest-residential-proxy-network","read_on":"2026-10-24","notes":"The survey named all three as live candidates. None of the three has a page left to price, so there is no tier to compare and no free allowance to state."},"per_object_cap":{"stated":"not applicable","bytes":null,"source_url":"https://cloud.google.com/blog/topics/threat-intelligence/disrupting-largest-residential-proxy-network","notes":"No object is stored by an exit-IP product, and nothing is served now in any case."},"retention":{"stated":"not applicable: an address product, not stored bytes","days":null,"source_url":"https://cloud.google.com/blog/topics/threat-intelligence/disrupting-largest-residential-proxy-network","notes":"A purchased balance or a pinned session is the nearest thing these vendors sold, and none can be read: two names do not resolve and the third serves a seizure notice."},"egress":{"terms":"unstated: no live page carries a traffic position. lunaproxy.com and piaproxy.com return NXDOMAIN and 911.re answers with a seizure notice, so whatever these three said about traffic out was never read and is not recorded here.","metered":false,"free_allowance":"none published","price_per_tb":null,"source_url":"https://cloud.google.com/blog/topics/threat-intelligence/disrupting-largest-residential-proxy-network"},"interface":["unknown"],"interface_detail":"Nothing is reachable: two of the three names have no DNS record and the third serves a seizure notice. The protocol these vendors sold was SOCKS5 and HTTP(S) per IP, which is what the names said (PIA S5, 911 S5) and what the one surviving stored copy of pia-proxy.com advertises ('Pay per IP over HTTP(S) and SOCKS5'); that describes the product, not a path a client can use today.","tooling":"Nothing to reach. A missing wrapper is not the obstacle: there is no service behind the name to wrap, so no client, SDK or protocol choice changes the outcome.","chaining":"Nothing chains. A vendor whose names do not resolve cannot carry the gateway's 45 GB a month, and the record's value is negative: it removes three names from the survey's candidate list so the next session does not spend a wave on them.","limits":[],"limits_note":"No constraint was measurable because no page was served. If any of the three had answered, the two kinds that would have been classified first are per-ip-shaping, because a residential exit pool is only worth its identity, and volume-quota, because every vendor in this class meters per GB. Both are unverified here rather than absent, and neither is claimed.","binding":"none","binding_note":"Nothing in the vocabulary fails at 45 GB a month because nothing is sold: two names do not resolve and the third serves a seizure notice, so no rate, cap, quota or shaping exists to hit. What removes these vendors is existence, which the seven-value vocabulary has no kind for and the verdict already names.","identity_cost":{"kind":"anonymous","detail":"n/a: no registration path exists, so no identity gate was reached. Nothing was signed up for and no account was created.","country":null},"reliability_note":"Two of the three names are gone at the DNS level and the third serves a seizure banner; the notice on 911.re reads 'This domain has been seized by the Defense Criminal Investigative Service, the Federal Bureau of Investigation, and the Bureau of Industry and Security, Office of Export Enforcement' as part of a coordinated action 'taken against the 911 S5 residential proxy service'.","confidence":"documented","confidence_note":"The death itself is measured: Cloudflare's resolver returned NXDOMAIN for lunaproxy.com and piaproxy.com, and 911.re served its seizure banner, all. Nothing would raise the death above measured; what would raise the attribution is a registry record of the deletion or a second independent account of the same action.","evidence":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/disrupting-largest-residential-proxy-network","date":"2026-10-24","proved":null},{"url":"probe:lunaproxy.com","date":"2026-10-24","proved":"Cloudflare DNS-over-HTTPS answered Status 3 (NXDOMAIN) with no A record, so the name has been removed from the .com zone rather than merely failing to answer."},{"url":"probe:piaproxy.com","date":"2026-10-24","proved":"Cloudflare DNS-over-HTTPS answered Status 3 (NXDOMAIN) with no A record."},{"url":"probe:pia-proxy.com","date":"2026-10-24","proved":"Not NXDOMAIN: resolves to 104.21.6.121 and 172.67.134.213 behind Cloudflare, and a fetch returned HTTP 522, meaning the edge has no origin behind it. The only readable text under this name was a stored third-party snapshot, titled 'PIA S5 Proxy — Residential SOCKS5 IPs, 350M+', which is a copy of the product page rather than a live page."},{"url":"probe:piaproxy.io","date":"2026-10-24","proved":"Resolves to 162.255.119.134 and returned HTTP 522; two read attempts, one at a 25 second deadline and one at 60, produced no page text, so no copy could be compared against pia-proxy.com's."},{"url":"https://911.re/","date":"2026-10-24","proved":"HTTP 200 with a page titled 'This Website Has Been Seized', whose body names the seizing agencies and states the action was 'taken against the 911 S5 residential proxy service'."}],"verdict":"dead","verified_at":"2026-10-24T10:07:11.000Z","price_per_tb_month":null,"notes":"Three candidates for why the names stopped answering, before any of them was tested. (1) The brands were shut with the rest of IPIDEA's marketing estate in the January 2026 action. (2) The domains lapsed on their own and the brands moved to new names. (3) A resolver-side filter returned NXDOMAIN falsely, which is a real failure mode here because the host resolver is a filtering one and it also reported lunaproxy.com as non-existent. Refuted for (3) by asking Cloudflare's resolver directly, which returned Status 3 for lunaproxy.com and piaproxy.com; a filtered answer would have come from the filter, not from the .com zone's authority. THE FACTS THIS RECORD CORRECTS: the survey sentence says pia-proxy.com returns NXDOMAIN. It does not. It resolves behind Cloudflare and returns 522, with no origin; The likely cause is that the two names were read as one. UNVERIFIED: the survey also records two lookalike 'continuation' sites carrying identical copy. Two PIA-adjacent names do resolve, pia-proxy.com and piaproxy.io, and both sit behind Cloudflare with no answering origin, so neither served a page to compare. piaproxy.net is a different company entirely, Private Internet Access, and pias5.com, pia-s5.com and piaproxy.co have no A record. So the pair may be exactly those two 522 hosts, or something else, and this record does not say. What would settle it: a stored snapshot for piaproxy.io to compare against the pia-proxy.com copy, or a registration-date read for both names. SINGLE SAMPLE: every DNS check here is one query per name from one resolver on one day, and the 522s were single fetches; a second resolver and a second day would turn a one-day observation into a trend, which for a domain is worth little either way. No record in another topic names these three as live, so there is no cross-topic correction to file; the correction is to the survey sentence itself. What the record exists to prevent is the thing the note in the assignment names: a dead vendor with no record gets re-attempted by whoever has the idea next, and re-attempting these three costs a search, a fetch and a decision before it reaches the same wall.","extras":{"rung":1,"rung_note":"Session, and only as a floor: what these three sold was a session-bound exit address, and nothing above rung 1 was ever established for them here, since no page was served to measure an account, fingerprint or behaviour control against.","interface_enum_note":"The schema's interface enum has no token for a proxy endpoint or a tunnel, so this record follows the convention the egress records use: a proxy client or tunnel is 'cli', a vendor API is 'rest'. Previous value: ['none']"}},"claims":[{"path":"$.free_tier.stated","kind":"free-quota","num":null,"unit":null,"per":null,"currency":null,"usd":null,"fx_date":null,"parse":"unparsed"}],"unknown":[["$.evidence[0].proved","withheld"],["$.interface","interface-unknown"],["$.per_object_cap.stated","not-applicable"]],"history":[],"drift":[]}