LunaProxy, PIA S5 Proxy and 911 S5 (911.re)
- Free allowance
- No live offer. lunaproxy.com and piaproxy.com return NXDOMAIN, and 911.re serves a seizure notice in place of a product page, all read 2026-10-24.
- Verdict
- deadthe offer or the service no longer exists
- Cost
- no price stated
- Identity
- anonymousno card, no phone
- Binding limit
- noneno named constraint binds
- Evidence
- documented6 sources; a first-party page was read and the sentence quoted
- Freshness
- checked 2026-10-25checked 2026-10-25 (live)
| Free tier | No live offer. lunaproxy.com and piaproxy.com return NXDOMAIN, and 911.re serves a seizure notice in place of a product page, all read 2026-10-24. Nothing was priced because nothing answers. unit none; metered on none; None of the three has a page left to price, so there is no tier to compare and no free allowance to state. |
|---|---|
| Price | none stated |
| Binding | none Nothing in the vocabulary fails at 45 GB a month because nothing is sold: two names do not resolve and the third serves a seizure notice, so no rate, cap, quota or shaping exists to hit. What removes these vendors is existence, which the seven-value vocabulary has no kind for and the verdict already names. |
| Identity | anonymous n/a: no registration path exists, so no identity gate was reached. Nothing was signed up for and no account was created. |
| Egress | unstated: no live page carries a traffic position. lunaproxy.com and piaproxy.com return NXDOMAIN and 911.re answers with a seizure notice, so whatever these three said about traffic out was never read and is not recorded here. free allowance: none published |
| Retention | not applicable: an address product, not stored bytes |
| Interface | unknown Nothing is reachable: two of the three names have no DNS record and the third serves a seizure notice. The protocol these vendors sold was SOCKS5 and HTTP(S) per IP, which is what the names said (PIA S5, 911 S5) and what the one surviving stored copy of pia-proxy.com advertises ('Pay per IP over HTTP(S) and SOCKS5'); that describes the product, not a path a client can use today. |
| Tooling | Nothing to reach. A missing wrapper is not the obstacle: there is no service behind the name to wrap, so no client, SDK or protocol choice changes the outcome. |
| Composes with | Nothing chains. |
| Reliability | Two of the three names are gone at the DNS level and the third serves a seizure banner; the notice on 911.re reads 'This domain has been seized by the Defense Criminal Investigative Service, the Federal Bureau of Investigation, and the Bureau of Industry and Security, Office of Export Enforcement' as part of a coordinated action 'taken against the 911 S5 residential proxy service'. |
| Notes | A filtered answer would have come from the filter, not from the .com zone's authority. It does not. It resolves behind Cloudflare and returns 522, with no origin; The likely cause is that the two names were read as one. Two PIA-adjacent names do resolve, pia-proxy.com and piaproxy.io, and both sit behind Cloudflare with no answering origin, so neither served a page to compare. piaproxy.net is a different company entirely, Private Internet Access, and pias5.com, pia-s5.com and piaproxy.co have no A record. So the pair may be exactly those two 522 hosts, or something else, and this record does not say. What would settle it: a stored snapshot for piaproxy.io to compare against the pia-proxy.com copy, or a registration-date read for both names. SINGLE SAMPLE: every DNS check here is one query per name from one resolver on one day, and the 522s were single fetches; a second resolver and a second day would turn a one-day observation into a trend, which for a domain is worth little either way. |
| Evidence note | documented The death itself is measured: Cloudflare's resolver returned NXDOMAIN for lunaproxy.com and piaproxy.com, and 911.re served its seizure banner, all. Nothing would raise the death above measured; what would raise the attribution is a registry record of the deletion or a second independent account of the same action. |
Evidence 6
| date | source | what it proved |
|---|---|---|
| 2026-10-24 | cloud.google.com/blog/topics/threat-intelligence/disrupting- | not published |
| 2026-10-24 | probe: lunaproxy.com | Cloudflare DNS-over-HTTPS answered Status 3 (NXDOMAIN) with no A record, so the name has been removed from the .com zone rather than merely failing to answer. |
| 2026-10-24 | probe: piaproxy.com | Cloudflare DNS-over-HTTPS answered Status 3 (NXDOMAIN) with no A record. |
| 2026-10-24 | probe: pia-proxy.com | Not NXDOMAIN: resolves to 104.21.6.121 and 172.67.134.213 behind Cloudflare, and a fetch returned HTTP 522, meaning the edge has no origin behind it. The only readable text under this name was a stored third-party snapshot, titled 'PIA S5 Proxy — Residential SOCKS5 IPs, 350M+', which is a copy of the product page rather than a live page. |
| 2026-10-24 | probe: piaproxy.io | Resolves to 162.255.119.134 and returned HTTP 522; two read attempts, one at a 25 second deadline and one at 60, produced no page text, so no copy could be compared against pia-proxy.com's. |
| 2026-10-24 | 911.re/ | HTTP 200 with a page titled 'This Website Has Been Seized', whose body names the seizing agencies and states the action was 'taken against the 911 S5 residential proxy service'. |
More fields 3
{
"rung": 1,
"rung_note": "Session, and only as a floor: what these three sold was a session-bound exit address, and nothing above rung 1 was ever established for them here, since no page was served to measure an account, fingerprint or behaviour control against.",
"interface_enum_note": "The schema's interface enum has no token for a proxy endpoint or a tunnel, so this record follows the convention the egress records use: a proxy client or tunnel is 'cli', a vendor API is 'rest'. Previous value: ['none']"
}Unknown values 2
$.interfacethe access interface was not established$.per_object_cap.statedthe field does not apply to this kind of offer