1,900 ten-thousand devices on borrowed home internet: the 911S5 takedown
Follow the residential-proxy botnet run from 2014 to 2022 until its May (month 5) 2024 takedown by a 4-country coalition. Troll infrastructure lives in home connections, not buildings.
Updated Oct 17, 2026
Documented facts
Chinese national YunHe Wang is accused of creating and running the residential-proxy service 911S5 from 2014 to July (month 7) of 2022. He was arrested in Singapore on 2024-05-24, the US Treasury sanctioned Wang with 2 associates and 3 Thai entities on 2024-05-28, and the US Justice Department announced the takedown on 2024-05-29. The network spanned more than 190 countries with 1,900 ten-thousand infected devices and more than 1,900 ten-thousand unique IPs, including 613,841 in the United States, spread through free VPNs and pirated software, with 76 of its 150 servers rented from US providers. Wang allegedly took in about 9,900 ten-thousand dollars selling access, buying 4 luxury cars, expensive watches, and 21 properties across 5 jurisdictions — the US, China, Singapore, Thailand, and the UAE — while the operation disabled 23 domains and more than 70 servers and seized about 3,000 ten-thousand dollars in assets. Conviction on all counts could bring up to 65 years in prison.
What the numbers say
This record supports the video's argument. Because the 1,900 ten-thousand IPs belonged to real home devices, the traffic looked like ordinary users, and the takedown needed law enforcement — a Singapore arrest, a 4-country coalition, 23 seized domains — not airstrikes. A market moving about 9,900 ten-thousand dollars in access sales explains the persistence of the residential-connection rental trade. The contrast holds: infrastructure concentrated like Yandex falls to drones, while infrastructure scattered across homes does not disappear with building strikes.
How residential proxies work
A residential proxy relays requests through real users' device IPs to hide their origin. While social platforms suspect data-center traffic of automation, home IPs pass as legitimate users, evading blocks and detection. 911S5 was a rental business exploiting that trust, with free VPNs and pirated software as its device-recruitment channel.
Limits
Scale figures are Justice Department announcements and estimates, and the announcement came at the indictment stage, before any conviction. The 911S5 charges center on financial fraud and unemployment-benefit fraud, so this record alone cannot establish it as any specific election operation's infrastructure. Nor does one network's takedown end the residential-proxy market as a whole.