922 S5 Proxy was a proxy seller at 922proxy.com from August 2022 to the end of January 2026. Its first archived page called it a "Perfect replacement for 911". Its contact page named the company behind it as FIRENET LIMITED, with an address in Wan Chai, Hong Kong, and a company of that name at the same address owns the US trademark 922. On 28 January 2026 Google named 922 Proxy among thirteen brands it says the actors behind the IPIDEA network control. The archive holds no working page after 30 January 2026, and the domain expired in August 2026. The story below keeps to date order and names the record behind each date.
922 S5 Proxy at a glance
| what the records show | |
|---|---|
| status | gone: the domain expired on 17 August 2026 and has no DNS answer |
| names | 922 S5 Proxy, 922S5Proxy, 922 Proxy; sister sites proxys5.net and 922data.com |
| company named | FIRENET LIMITED, Hennessy Road, Wan Chai, Hong Kong, on its contact page from July 2023 |
| trademark | US 7325837 "922", owned by FIRENET LIMITED, registered 12 March 2024 |
| contract | named no company; British Virgin Islands law from 2022, Hong Kong law from 2025 |
| register | FIRENET LIMITED could not be read in the Hong Kong register |
| online from | domain registered 17 August 2022, first certificate the next day |
| last working page | 30 January 2026, in the Internet Archive |
| named on its IPIDEA list of 28 January 2026 | |
| court records | none name 922 S5 Proxy or FIRENET LIMITED |
| Trustpilot | 2.2 from 99 reviews, archived 9 February 2026 |
We read every record on 10 and 11 October 2026, every web page from our server in St. Louis: the domain registry, the certificate logs, the Internet Archive, the US trademark office, TMview, US court dockets, US government releases, Google's posts, Trustpilot's archived pages, and 922 S5 Proxy's own pages and Telegram channel.
The story, oldest first
A solid marker is a record we read in a registry, an archive or a public database. A hollow marker is what the company said about itself.
August 2022: "a perfect replacement for 911"
The business left its first trace on 17 August 2022. Its Telegram channel, @proxy922, logged "Channel created" at 11:11 UTC that day. Five hours later, at 16:23 UTC, 922proxy.com was registered at NameCheap, Verisign's registry shows. The certificate logs record the first certificates for the domain and its sub-addresses on 18 August 2022.
The first archived page dates from 23 August 2022. Its pitch was direct: "Perfect replacement for 911". The next line read: "The 922 S5 is 1:1 compatible with the 911 S5's features and goes beyond the 911 S5's residential proxy service." The page offered a Windows client and counted "217,303,918 IPs".
The footer carried a company name: "Copyright © 2022 922s5proxy FIRENET LIMITED. All Rights Reserved". The archive shows that line on 23 and 26 August 2022. By 6 October 2022 the footer had no copyright line at all.
The pitch named a service with a public record. On 29 May 2024 the US Justice Department announced that the "911 S5 Botnet" had been dismantled and its administrator arrested. The indictment, it said, alleges malware that compromised computers "from 2014 through July 2022", tied to more than 19 million IP addresses.
922 kept the comparison going into 2024. A blog post archived in September 2023 says: "After 911 S5 Proxy exited the market, 922 S5 Proxy took over its role." Another, archived in March 2024, says 911 S5 "was withdrawn from the market due to cyber attacks".
The Justice Department release does not mention 922, and neither does the US Treasury's sanctions notice of 28 May 2024. No record we read ties the people behind 922 S5 Proxy to the operator of 911 S5.
A contract that named no company
The first terms of service, "Last updated on August 18, 2022", said the service "is owned and maintained by 922 S5 and its affiliates". They named no company, no country and no law. The privacy policy of the same date gave a Gmail address as its only contact.
A new version, "Last updated on November 8, 2022", reached the archive in December 2022. It was an agreement with "the owner and operator of 922proxy.com", still without a name. It chose "the laws in force in the British Virgin Islands", with arbitration there or the courts of Tortola. A later clause of the same text chose "the laws of UK".
The same contract described the product in one line: a service "redirecting users' communication through other users' devices". That wording stayed in every later version we read.
The terms changed once more. A version "Last updated on October 17, 2025", first archived on 3 December 2025, chose "the laws of the Hong Kong Special Administrative Region" and its courts. It still named no company, and neither did any of the 38 versions of the terms and privacy policy we read.
Two more addresses: proxys5.net and 922data.com
A second domain carried the software. proxys5.net was registered on 31 August 2022, also at NameCheap. From October 2022 the client downloads came from that domain, and in 2023 and 2024 the archive found a full copy of the 922 site there, terms included.
A third name sold the same brand. 922data.com was registered on 11 October 2022 at Aceville Pte. Ltd., with name servers at alidns.com. 922proxy.com linked to it from January 2023. Its title in April 2024 read "Top-notch Proxy Services, Quality Data Solutions | 922Proxy - 922data.com".
2022 to 2024: growth, by its own account
The product was a desktop client that forwarded each bought IP to a local port. In October 2022 the homepage sold 240 IPs for $48, or $0.20 an IP, and called the balance "valid for life". The pricing page of that month took cards, UnionPay, crypto and "Local Payment" through Paymentwall.
The Telegram channel logged the pace. Traditional Chinese and Vietnamese sites came in October 2022 and a Mac client on 3 November 2022. Russian and Alipay followed in February 2023. Traffic plans sold by the gigabyte started on 15 August 2023, "as low as $0.8 per GB", and VPS hosting on 31 October 2023.
The size claims stayed round. From October 2022 the homepage promised "Over 200M IPs active worldwide". On 12 May 2023 the channel announced "Added 120M+" addresses: "30 million in Europe, 40 million in Asia, and 50 million in the United States". The homepage total stayed at 200 million.
Some claims ran ahead of the record. On 21 April 2023 the channel celebrated a "3rd Anniversary", eight months after the domain and the channel were created. From 2023 the About page claimed "more than 10 years of professional experience leading the proxy industry".
On 4 September 2024 the channel announced its own end: "922S5Proxy official channel moved to WhatsApp!" It still showed 5.28K subscribers when we read it.
July 2023: FIRENET LIMITED, Wan Chai
In July 2023 the contact page gave the company a full address. The archive's copy of 20 July 2023 reads: "Company Name: FIRENET LIMITED / Company Address: ROOM H, 10/F, NEW HENNESSY TOWER, 263 HENNESSY ROAD, WANCHAI HONG KONG". The same lines appear in all 22 archived versions, the last from 5 January 2026.
The earlier contact page, archived in December 2022 and March 2023, listed only a Telegram handle. The contract never took the name over.
The US trademark office holds the same name at the same address. Registration 7325837, for the mark 922, belongs to FIRENET LIMITED, a limited company of Hong Kong at Room H, 10/F, New Hennessy Tower, 263 Hennessy Road, Wan Chai. It was filed on 2 February 2023 and registered on 12 March 2024. The file claims first use "Aug. 20, 2022", three days before the first archived page, for services such as "Internet Protocol (IP) address verification services".
We could not read the company in a register. Hong Kong's company search is a script application with a captcha, and we do not get past captchas. OpenCorporates, which copies the Hong Kong register, found no company called FIRENET LIMITED.
Two smaller traces point the same way. The Trustpilot profile of www.922proxy.com, claimed by the business, gave Hong Kong as its country. By January 2026 the site's WhatsApp contact carried the Hong Kong code +852.
2024: an SDK for app makers
On 6 May 2024 the archive caught a new page on 922proxy.com: "922 S5 Proxy SDK". It invited app makers to "Make money by selling your unused IP addresses". It added: "922 S5 Proxy SDK pays you on top of your existing ad revenue, but runs silently in the background."
The page said users would "opt in" and that "No user data is collected". Versions stayed in the archive until 13 March 2025, and a copy sat on proxys5.net in June 2024. No page we read names an app that carried the SDK.
January 2026: Google's list
On 28 January 2026 Google's Threat Intelligence Group published "No Place Like Home Network: Disrupting the World's Largest Residential Proxy Network". It named thirteen "ostensibly independent proxy and VPN brands" and said they are "controlled by the actors behind IPIDEA". The list includes "922 Proxy (922proxy.com)".
Google described a network used by attackers: "over 550 individual threat groups" used IPIDEA exit nodes in one week of January 2026, it said. It also wrote that IPIDEA's SDKs "surreptitiously enroll user devices" into the network, and it named four of them: Castar, Earn, Hex and Packet. It did not name a 922 SDK.
Its actions included "legal action to take down the domains used to market IPIDEA's products", removals by Play Protect on Android, and work with Cloudflare "to disrupt IPIDEA's domain resolution". Two days later Google's own blog said: "We disrupted IPIDEA by taking down their online storefront and took them to court".
Google's post of 28 January also lists, under "File Indicators", the signers of code-signing certificates. Five Hong Kong companies appear there, and one is FIRENET LIMITED, in two entries: one with the locality Wan Chai, one with Hong Kong Island. Google does not say which files those certificates signed, and no register we read shows that these entries and 922's company are one firm.
The trademark register adds a pattern. Companies with three of those five names hold or filed US marks that carry the names of brands on Google's list. FIRENET LIMITED owns 922, and a FIRENET LIMITED with an address in Kwun Tong applied for CHERRY PROXY on 7 May 2025; the application was abandoned on 2 January 2026. MARS BROTHERS LIMITED holds PIAS5-PROXY IP ACCESS and filed for PIAPROXY, PIAS5PROXY and LUNA. HongKong Lingyun MDT Infotech Limited holds 360PROXY.
The site stopped soon after Google's post. A certificate for doc.922proxy.com was issued at 12:15 UTC on 28 January 2026. The archive's last working capture of a 922proxy.com page is from 06:23 UTC on 30 January 2026.
Our own registry read of 23 April 2026 found the domain on "client hold", last updated on 28 January 2026. Its name servers were blockedforabuse.pleasecontactsupport.com and dummysecondary.pleasecontactsupport.com. On 10 October 2026 tabproxy.com, another brand on Google's list, showed the same name servers and the same date.
Customers noticed at once. A Trustpilot review of 31 January 2026 says the site "is not coming up anymore since 28th of January". Another, of 1 February, reads: "The seller has absconded, and I still have 100GB of data". We found no statement by 922 S5 Proxy about the end.
After the end
The second storefront lasted a few more days. The archive found 922data.com answering until 7 February 2026. On 2 February its download host still served an Android file with the same name as the one 922proxy.com had offered.
The registry then shows a pattern. 922data.com, piaproxy.com and lunaproxy.com share the registrar Aceville Pte. Ltd., the same alidns.com name servers and the same last change, on 5 March 2026, and all three are on hold. PIA S5 Proxy and Luna Proxy are on Google's list. A shared registrar and the same date do not show a shared owner.
922proxy.com itself was never renewed. Its registration expired on 17 August 2026. On 10 October 2026 the registry listed it in its "redemption period" and on hold, and the .com servers answered that the name does not exist. proxys5.net is on hold too, registered until August 2027.
Other names on Google's list met different ends. On 10 October 2026 abcproxy.com and doorvpn.com sat with the "Stichting Registrar of Last Resort Foundation", on name servers at shadowserver.org. ip2world.com, pyproxy.com, galleonvpn.com and radishvpn.com carried new registrations dated July and August 2026.
In July 2026, in a post about another network, Google wrote that "observations after the disruption of IPIDEA proved that individual networks can appear resilient". Operators facing a weaker botnet, it said, "begin buying capacity from their competitors".
Who 922 S5 Proxy is connected to
| connection | what the record shows, and what it does not |
|---|---|
| FIRENET LIMITED | named on the contact page with a Wan Chai address, July 2023 to January 2026; owner of the US mark 922 at that address. Not shown: its owners or directors |
| Google's signer list | FIRENET LIMITED, Wan Chai, among five Hong Kong code-signers Google lists for IPIDEA. Not shown: which files, or one firm |
| IPIDEA | Google's list of 13 brands "controlled by the actors behind IPIDEA". Not shown: the people |
| Cherry Proxy | a FIRENET LIMITED, Kwun Tong, filed CHERRY PROXY in 2025. Not shown: one firm with the Wan Chai entry |
| proxys5.net | the download host and a copy of the site, 2022 to 2024. Not shown: who registered it |
| 922data.com | a second 922 Proxy storefront, 2022 to February 2026. Not shown: who registered it |
| piaproxy.com, lunaproxy.com | the registrar, name servers and hold date of 922data.com. Not shown: a shared owner |
| tabproxy.com | the abuse-block name servers and date of 922proxy.com. Not shown: why |
| 911 S5 | 922 called itself its "Perfect replacement". Not shown: any shared operator |
| Paymentwall, Alipay | payment options it announced in 2022 and 2023. Not shown: anything beyond payments |
Our page on the IPIDEA cluster covers the other brands on Google's list, and our hub on who owns your proxy provider maps the larger groups.
In court and in filings
No US court record we found names 922 S5 Proxy, 922proxy.com or FIRENET LIMITED. CourtListener returned no docket for those names, or for the four other companies in Google's signer list, on 10 October 2026. That search covers US federal courts only.
One filing sits close to the end. In Google LLC v. Does 1-25, the BadBox 2.0 botnet case in the Southern District of New York (1:25-cv-04503), a permanent injunction of 18 September 2025 bars the defendants from "Engaging in the sale of proxy services". On 27 January 2026 Google wrote to the court about its "intention to take down additional domains". The list of domains is under seal and was amended on 28 January, 2 February and 25 February 2026, so we cannot see whether it names 922proxy.com.
What 922 S5 Proxy sold, in short
Its main product was SOCKS5 proxies sold by the IP. A buyer picked an address in the client by country, city or ISP and forwarded it to a local port. The pricing page of 13 January 2026 asked $0.045 an IP, and $0.03 on business plans. Static residential IPs cost $0.17 an IP a day.
From August 2023 it also sold traffic by the gigabyte. The lowest rate on the pricing page went from $0.70 in January 2024 to $0.77 from August 2024, then to $0.65 on business plans in January 2026. Unlimited plans cost $1,825 a month that January.
The fine print was strict. Its refund policy, "Last updated on November 30th, 2022", said "All payments are final", and the terms of October 2025 repeat it. On sourcing, the contract spoke of "other users' devices", and the SDK page of apps. No page we read named an app.
What customers report
Trustpilot's page for www.922proxy.com shows 2.3 from 24 reviews in March 2023 and 3.2 from 138 in March 2025. By February 2026 it showed 2.2 from 99 reviews. Complaints in the captures of 2024 and 2025 name flagged IPs, slow support and refused refunds. Trustpilot refused our server on 10 October 2026, so the archive's capture of 9 February 2026 is the last reading.
Is 922 S5 Proxy legit?
It was a real business while it lasted. From August 2022 to January 2026 it shipped dated client releases for Windows, Mac, Linux and Android, kept a price list, answered reviews, and named a company that also registered its brand in the US.
What the records lack is a company you could hold to the contract. The terms never named one. The one company named elsewhere, FIRENET LIMITED, cannot be checked in a register we could read. Google says the brand was controlled by the actors behind IPIDEA, and since January 2026 the service does not exist.
If you are looking elsewhere
- If you had a balance at 922 S5 Proxy, we found no statement from the company about refunds, and its terms said all payments were final. Our page on what happened to 922 S5 Proxy covers the end for former customers.
- If you want a provider outside the IPIDEA group, our page on the brands Google named lists all thirteen.
- If you want the company behind a provider named in its contract, read the terms first: 922's named none in three years. HProxy sells $0.50/GB for one gigabyte of Lite, the balance never expires, and no proxy or VPN group owns HProxy. Our proxy checker is free and tests a proxy from any seller without an account.
What we could not find out
- Who owns and directs FIRENET LIMITED, and when it was formed. The Hong Kong register sits behind a captcha, and OpenCorporates holds no copy.
- Whether the FIRENET LIMITED of Wan Chai is the one in Google's signer list and the one in Kwun Tong, and which files that certificate signed.
- Who ran 922 S5 Proxy before July 2023, when the contact page first named a company, and why its 2022 contract chose British Virgin Islands law.
- Whether 922proxy.com is on the sealed list Google filed with the court on 27 January 2026.
- Which apps supplied its residential addresses. Its terms and its SDK page describe other users' devices but name no app.
- What happened to customer balances after January 2026.
We bought nothing, downloaded nothing and tested no 922 proxy: our rule is to read and never to buy. Registry states and archive captures change. We will check this page against the records again by 11 January 2027.
Sources
- Verisign RDAP: 922proxy.com, proxys5.net, 922data.com and the eleven other .com domains on Google's list; Identity Digital RDAP: ipidea.io. Read 10 October 2026. Our own RDAP read of 922proxy.com of 23 April 2026.
- Certificate logs (crt.sh): 922proxy.com and proxys5.net. Read 10 October 2026.
- Internet Archive: 922proxy.com from 2022 to 2026 (homepage, terms, privacy, refund, delivery, contact, About, pricing, SDK and blog pages), proxys5.net, 922data.com, and Trustpilot's page for www.922proxy.com. Read 10 October 2026.
- 922 S5 Proxy: its Telegram channel @proxy922, from its first entry of 17 August 2022 to its last post of 4 September 2024. Read 10 October 2026.
- US Patent and Trademark Office: registration 7325837 (serial 97777741, "922") and application 99174052 ("CHERRY PROXY"), status pages and owner search. Read 11 October 2026.
- TMview, the trademark search of the EU's office network: searches for 922, 922 S5, 922 PROXY and FIRENET. Read 10 and 11 October 2026.
- Google Threat Intelligence Group, "No Place Like Home Network: Disrupting the World's Largest Residential Proxy Network", 28 January 2026; Google, "Google Threat Intelligence Group shuts down IPIDEA proxy network", 30 January 2026; Google Threat Intelligence Group, "Google's Continued Disruption of Malicious Residential Proxy Networks", 2 July 2026. Read 10 October 2026.
- US courts, through CourtListener: searches for 922proxy, 922 S5, FIRENET LIMITED and the other signer names; Google LLC v. Does 1-25 (S.D.N.Y. 1:25-cv-04503), docket and permanent injunction of 18 September 2025. Read 10 October 2026.
- US Department of Justice, "911 S5 Botnet Dismantled and Its Administrator Arrested in Coordinated International Operation", 29 May 2024, as archived; US Treasury, "Treasury Sanctions a Cybercrime Network Associated with the 911 S5 Botnet", 28 May 2024. Read 10 October 2026.
- OpenCorporates (Hong Kong) and the Hong Kong Companies Registry search page. Read 10 and 11 October 2026.
- Our own checks from the server: DNS answers for 922proxy.com and the .com zone. 10 October 2026.
