922 S5 Proxy (922proxy.com): the company behind it, FIRENET LIMITED, and its end

922 S5 Proxy was a proxy seller at 922proxy.com from August 2022 to the end of January 2026. Its first archived page called it a "Perfect replacement for 911". Its contact page named the company behind it as FIRENET LIMITED, with an address in Wan Chai, Hong Kong, and a company of that name at the same address owns the US trademark 922. On January 28, 2026, Google named 922 Proxy among thirteen brands it says the actors behind the IPIDEA network control. The archive holds no working page after January 30, 2026, and the domain expired in August 2026. The story below keeps to date order and names the record behind each date.

922 S5 Proxy at a glance

We read every record on October 10 and 11, 2026, every web page from our server in the United States: the domain registry, the Internet Archive, the US trademark office, TMview, US court dockets, US government releases, Google's posts, Trustpilot's archived pages, and 922 S5 Proxy's own pages and Telegram channel.

The story, oldest first

A solid marker is a record we read in a registry, an archive or a public database. A hollow marker is what the company said about itself.

August 2022: "a perfect replacement for 911"

The business left its first trace on August 17, 2022. Its Telegram channel, @proxy922, logged "Channel created" at 11:11 UTC that day. Five hours later, at 16:23 UTC, 922proxy.com was registered at NameCheap, Verisign's registry shows.

The first archived page dates from August 23, 2022. Its pitch was direct: "Perfect replacement for 911". The next line read: "The 922 S5 is 1:1 compatible with the 911 S5's features and goes beyond the 911 S5's residential proxy service." The page offered a Windows client and counted "217,303,918 IPs".

The footer carried a company name: "Copyright © 2022 922s5proxy FIRENET LIMITED. All Rights Reserved". The archive shows that line on August 23 and 26, 2022. By October 6, 2022, the footer had no copyright line at all.

The pitch named a service with a public record. On May 29, 2024, the US Justice Department announced that the "911 S5 Botnet" had been dismantled and its administrator arrested. The indictment, it said, alleges malware that compromised computers "from 2014 through July 2022", tied to more than 19 million IP addresses.

922 kept the comparison going into 2024. A blog post archived in September 2023 says: "After 911 S5 Proxy exited the market, 922 S5 Proxy took over its role." Another, archived in March 2024, says 911 S5 "was withdrawn from the market due to cyber attacks".

The Justice Department release does not mention 922, and neither does the US Treasury's sanctions notice of May 28, 2024. No record we read ties the people behind 922 S5 Proxy to the operator of 911 S5.

A contract that named no company

The first terms of service, "Last updated on August 18, 2022", said the service "is owned and maintained by 922 S5 and its affiliates". They named no company, no country and no law. The privacy policy of the same date gave a Gmail address as its only contact.

A new version, "Last updated on November 8, 2022", reached the archive in December 2022. It was an agreement with "the owner and operator of 922proxy.com", still without a name. It chose "the laws in force in the British Virgin Islands", with arbitration there or the courts of Tortola. A later clause of the same text chose "the laws of UK".

The same contract described the product in one line: a service "redirecting users' communication through other users' devices". That wording stayed in every later version we read.

The terms changed once more. A version "Last updated on October 17, 2025", first archived on December 3, 2025, chose "the laws of the Hong Kong Special Administrative Region" and its courts. It still named no company, and neither did any of the 38 versions of the terms and privacy policy we read.

Two more addresses: proxys5.net and 922data.com

A second domain carried the software. proxys5.net was registered on August 31, 2022, also at NameCheap. From October 2022 the client downloads came from that domain, and in 2023 and 2024 the archive found a full copy of the 922 site there, terms included.

A third name sold the same brand. 922data.com was registered on October 11, 2022, at Aceville Pte. Ltd., with name servers at alidns.com. 922proxy.com linked to it from January 2023. Its title in April 2024 read "Top-notch Proxy Services, Quality Data Solutions | 922Proxy - 922data.com".

2022 to 2024: growth, by its own account

The product was a desktop client that forwarded each bought IP to a local port. In October 2022 the homepage sold 240 IPs for $48, or $0.20 an IP, and called the balance "valid for life". The pricing page of that month took cards, UnionPay, crypto and "Local Payment" through Paymentwall.

The Telegram channel logged the pace. Traditional Chinese and Vietnamese sites came in October 2022 and a Mac client on November 3, 2022. Russian and Alipay followed in February 2023. Traffic plans sold by the gigabyte started on August 15, 2023, "as low as $0.8 per GB", and VPS hosting on October 31, 2023.

The size claims stayed round. From October 2022 the homepage promised "Over 200M IPs active worldwide". On May 12, 2023, the channel announced "Added 120M+" addresses: "30 million in Europe, 40 million in Asia, and 50 million in the United States". The homepage total stayed at 200 million.

Some claims ran ahead of the record. On April 21, 2023, the channel celebrated a "3rd Anniversary", eight months after the domain and the channel were created. From 2023 the About page claimed "more than 10 years of professional experience leading the proxy industry".

On September 4, 2024, the channel announced its own end: "922S5Proxy official channel moved to WhatsApp!" It still showed 5.28K subscribers when we read it.

July 2023: FIRENET LIMITED, Wan Chai

In July 2023 the contact page gave the company a full address. The archive's copy of July 20, 2023, reads: "Company Name: FIRENET LIMITED / Company Address: ROOM H, 10/F, NEW HENNESSY TOWER, 263 HENNESSY ROAD, WANCHAI HONG KONG". The same lines appear in all 22 archived versions, the last from January 5, 2026.

The earlier contact page, archived in December 2022 and March 2023, listed only a Telegram handle. The contract never took the name over.

The US trademark office holds the same name at the same address. Registration 7325837, for the mark 922, belongs to FIRENET LIMITED, a limited company of Hong Kong at Room H, 10/F, New Hennessy Tower, 263 Hennessy Road, Wan Chai. It was filed on February 2, 2023, and registered on March 12, 2024. The file claims first use "Aug. 20, 2022", three days before the first archived page, for services such as "Internet Protocol (IP) address verification services".

We could not read the company in a register. Hong Kong's company search is a script application with a captcha, and we do not get past captchas. OpenCorporates, which copies the Hong Kong register, found no company called FIRENET LIMITED.

Two smaller traces point the same way. The Trustpilot profile of www.922proxy.com, claimed by the business, gave Hong Kong as its country. By January 2026 the site's WhatsApp contact carried the Hong Kong code +852.

2024: an SDK for app makers

On May 6, 2024, the archive caught a new page on 922proxy.com: "922 S5 Proxy SDK". It invited app makers to "Make money by selling your unused IP addresses". It added: "922 S5 Proxy SDK pays you on top of your existing ad revenue, but runs silently in the background."

The page said users would "opt in" and that "No user data is collected". Versions stayed in the archive until March 13, 2025, and a copy sat on proxys5.net in June 2024. No page we read names an app that carried the SDK.

January 2026: Google's list

On January 28, 2026, Google's Threat Intelligence Group published "No Place Like Home Network: Disrupting the World's Largest Residential Proxy Network". It named thirteen "ostensibly independent proxy and VPN brands" and said they are "controlled by the actors behind IPIDEA". The list includes "922 Proxy (922proxy.com)".

Google described a network used by attackers: "over 550 individual threat groups" used IPIDEA exit nodes in one week of January 2026, it said. It also wrote that IPIDEA's SDKs "surreptitiously enroll user devices" into the network, and it named four of them: Castar, Earn, Hex and Packet. It did not name a 922 SDK.

Its actions included "legal action to take down the domains used to market IPIDEA's products", removals by Play Protect on Android, and work with Cloudflare "to disrupt IPIDEA's domain resolution". Two days later Google's own blog said: "We disrupted IPIDEA by taking down their online storefront and took them to court".

Google's post of January 28 also lists, under "File Indicators", the signers of code-signing certificates. Five Hong Kong companies appear there, and one is FIRENET LIMITED, in two entries: one with the locality Wan Chai, one with Hong Kong Island. Google does not say which files those certificates signed, and no register we read shows that these entries and 922's company are one firm.

The trademark register adds a pattern. Companies with three of those five names hold or filed US marks that carry the names of brands on Google's list. FIRENET LIMITED owns 922, and a FIRENET LIMITED with an address in Kwun Tong applied for CHERRY PROXY on May 7, 2025; the application was abandoned on January 2, 2026. MARS BROTHERS LIMITED holds PIAS5-PROXY IP ACCESS and filed for PIAPROXY, PIAS5PROXY and LUNA. HongKong Lingyun MDT Infotech Limited holds 360PROXY.

The site stopped soon after Google's post. The archive's last working capture of a 922proxy.com page is from 06:23 UTC on January 30, 2026.

Our own registry read of April 23, 2026, found the domain on "client hold", last updated on January 28, 2026. Its name servers were blockedforabuse.pleasecontactsupport.com and dummysecondary.pleasecontactsupport.com. On October 10, 2026, tabproxy.com, another brand on Google's list, showed the same name servers and the same date.

Customers noticed at once. A Trustpilot review of January 31, 2026, says the site "is not coming up anymore since 28th of January". Another, of February 1, reads: "The seller has absconded, and I still have 100GB of data". We found no statement by 922 S5 Proxy about the end.

After the end

The second storefront lasted a few more days. The archive found 922data.com answering until February 7, 2026. On February 2 its download host still served an Android file with the same name as the one 922proxy.com had offered.

The registry then shows a pattern. 922data.com, piaproxy.com and lunaproxy.com share the registrar Aceville Pte. Ltd., the same alidns.com name servers and the same last change, on March 5, 2026, and all three are on hold. PIA S5 Proxy and Luna Proxy are on Google's list. A shared registrar and the same date do not show a shared owner.

922proxy.com itself was never renewed. Its registration expired on August 17, 2026. On October 10, 2026, the registry listed it in its "redemption period" and on hold, and the .com servers answered that the name does not exist. proxys5.net is on hold too, registered until August 2027.

Other names on Google's list met different ends. On October 10, 2026, abcproxy.com and doorvpn.com sat with the "Stichting Registrar of Last Resort Foundation", on name servers at shadowserver.org. ip2world.com, pyproxy.com, galleonvpn.com and radishvpn.com carried new registrations dated July and August 2026.

In July 2026, in a post about another network, Google wrote that "observations after the disruption of IPIDEA proved that individual networks can appear resilient". Operators facing a weaker botnet, it said, "begin buying capacity from their competitors".

Who 922 S5 Proxy is connected to

Our page on the IPIDEA cluster covers the other brands on Google's list, and our hub on who owns your proxy provider maps the larger groups.

In court and in filings

No US court record we found names 922 S5 Proxy, 922proxy.com or FIRENET LIMITED. CourtListener returned no docket for those names, or for the four other companies in Google's signer list, on October 10, 2026. That search covers US federal courts only.

One filing sits close to the end. In Google LLC v. Does 1-25, the BadBox 2.0 botnet case in the Southern District of New York (1:25-cv-04503), a permanent injunction of September 18, 2025, bars the defendants from "Engaging in the sale of proxy services". On January 27, 2026, Google wrote to the court about its "intention to take down additional domains". The list of domains is under seal and was amended on January 28, February 2 and February 25, 2026, so we cannot see whether it names 922proxy.com.

What 922 S5 Proxy sold, in short

Its main product was SOCKS5 proxies sold by the IP. A buyer picked an address in the client by country, city or ISP and forwarded it to a local port. The pricing page of January 13, 2026, asked $0.045 an IP, and $0.03 on business plans. Static residential IPs cost $0.17 an IP a day.

From August 2023 it also sold traffic by the gigabyte. The lowest rate on the pricing page went from $0.70 in January 2024 to $0.77 from August 2024, then to $0.65 on business plans in January 2026. Unlimited plans cost $1,825 a month that January.

The fine print was strict. Its refund policy, "Last updated on November 30th, 2022", said "All payments are final", and the terms of October 2025 repeat it. On sourcing, the contract spoke of "other users' devices", and the SDK page of apps. No page we read named an app.

What customers report

Trustpilot's page for www.922proxy.com shows 2.3 from 24 reviews in March 2023 and 3.2 from 138 in March 2025. By February 2026 it showed 2.2 from 99 reviews. Complaints in the captures of 2024 and 2025 name flagged IPs, slow support and refused refunds. Trustpilot refused our server on October 10, 2026, so the archive's capture of February 9, 2026, is the last reading.

Is 922 S5 Proxy legit?

It was a real business while it lasted. From August 2022 to January 2026 it shipped dated client releases for Windows, Mac, Linux and Android, kept a price list, answered reviews, and named a company that also registered its brand in the US.

What the records lack is a company you could hold to the contract. The terms never named one. The one company named elsewhere, FIRENET LIMITED, cannot be checked in a register we could read. Google says the brand was controlled by the actors behind IPIDEA, and since January 2026 the service does not exist.

If you are looking elsewhere

• If you had a balance at 922 S5 Proxy, we found no statement from the company about refunds, and its terms said all payments were final. Our page on what happened to 922 S5 Proxy covers the end for former customers.
• If you want a provider outside the IPIDEA group, our page on the brands Google named lists all thirteen.
• If you want the company behind a provider named in its contract, read the terms first: 922's named none in three years. HProxy sells $0.50/GB for one gigabyte of Lite, the balance never expires, and no proxy or VPN group owns HProxy. Our proxy checker is free and tests a proxy from any seller without an account.

What we could not find out

1. Who owns and directs FIRENET LIMITED, and when it was formed. The Hong Kong register sits behind a captcha, and OpenCorporates holds no copy.
2. Whether the FIRENET LIMITED of Wan Chai is the one in Google's signer list and the one in Kwun Tong, and which files that certificate signed.
3. Who ran 922 S5 Proxy before July 2023, when the contact page first named a company, and why its 2022 contract chose British Virgin Islands law.
4. Whether 922proxy.com is on the sealed list Google filed with the court on January 27, 2026.
5. Which apps supplied its residential addresses. Its terms and its SDK page describe other users' devices but name no app.
6. What happened to customer balances after January 2026.

We bought nothing, downloaded nothing and tested no 922 proxy: our rule is to read and never to buy. Registry states and archive captures change. We will check this page against the records again by January 11, 2027.

Sources

• Verisign RDAP: 922proxy.com, proxys5.net, 922data.com and the eleven other .com domains on Google's list; Identity Digital RDAP: ipidea.io. Read October 10, 2026. Our own RDAP read of 922proxy.com of April 23, 2026.
• Internet Archive: 922proxy.com from 2022 to 2026 (homepage, terms, privacy, refund, delivery, contact, About, pricing, SDK and blog pages), proxys5.net, 922data.com, and Trustpilot's page for www.922proxy.com. Read October 10, 2026.
• 922 S5 Proxy: its Telegram channel @proxy922, from its first entry of August 17, 2022, to its last post of September 4, 2024. Read October 10, 2026.
• US Patent and Trademark Office: registration 7325837 (serial 97777741, "922") and application 99174052 ("CHERRY PROXY"), status pages and owner search. Read October 11, 2026.
• TMview, the trademark search of the EU's office network: searches for 922, 922 S5, 922 PROXY and FIRENET. Read October 10 and 11, 2026.
• Google Threat Intelligence Group, "No Place Like Home Network: Disrupting the World's Largest Residential Proxy Network", January 28, 2026; Google, "Google Threat Intelligence Group shuts down IPIDEA proxy network", January 30, 2026; Google Threat Intelligence Group, "Google's Continued Disruption of Malicious Residential Proxy Networks", July 2, 2026. Read October 10, 2026.
• US courts, through CourtListener: searches for 922proxy, 922 S5, FIRENET LIMITED and the other signer names; Google LLC v. Does 1-25 (S.D.N.Y. 1:25-cv-04503), docket and permanent injunction of September 18, 2025. Read October 10, 2026.
• US Department of Justice, "911 S5 Botnet Dismantled and Its Administrator Arrested in Coordinated International Operation", May 29, 2024, as archived; US Treasury, "Treasury Sanctions a Cybercrime Network Associated with the 911 S5 Botnet", May 28, 2024. Read October 10, 2026.
• OpenCorporates (Hong Kong) and the Hong Kong Companies Registry search page. Read October 10 and 11, 2026.
• Our own checks from the server: DNS answers for 922proxy.com and the .com zone. October 10, 2026.