PIA S5 Proxy (piaproxy.com): the company, its owners and how it ended

PIA S5 Proxy was a residential proxy shop at piaproxy.com, opened in July 2022 and offline since early 2026. Its trademarks, its Android app and its own pages from 2025 name one company: Mars Brothers Limited, a Hong Kong company at 31 Tonkin Street in Cheung Sha Wan. On January 28, 2026, Google listed PIA S5 Proxy among the brands it says are "controlled by the actors behind IPIDEA". Since March 5, 2026, the domain has been on hold. Below is the record in order of date, each fact with the register, archive or filing it comes from.

PIA S5 Proxy at a glance

We read the records on October 10 and 11, 2026: domain records, 290 archived copies of its pages, app store copies and Google's posts from our server in the United States, and the trademark and court indexes, which refused that server, from our office.

The story, oldest first

A solid marker is a record we read in a register, an archive, a court file or a dated publication. A hollow marker is what PIA S5 Proxy or its owner said about itself.

An IP changer before a proxy shop

The business is older than its best-known name. A US trademark file records an application by Mars Brothers Limited for PIA PROXY MANAGER, filed on August 3, 2022. It claims first use on December 16, 2021.

The current registration of ipchanger.net dates from April 13, 2022, at the registrar and on the name servers piaproxy.com would later use. On July 21, 2022, it showed a page for "PIA Proxy Manager". A Google Play copy of the next day lists an Android app, "PIA VPN: IP Changer Safe Proxy", by MARS BROTHERS LIMITED. It had more than 10,000 downloads and 321 reviews at 5.0. The developer address read: Suite 603, 6/F, Hang Pont Commercial Building, 31 Tonkin Street.

July 2022: followers, likes and reviews

piaproxy.com was registered on July 21, 2022. The first archived page, of July 25, 2022, sold "PIA Proxy Manager", a "Free Residential Proxy Client".

The page listed what buyers could do with it. "Register accounts in batches", "Add more followers" and "Bulk comments and likes" came first. Another heading read: "Bulk positive reviews: Need lots of positive reviews? Solve IP restrictions and achieve unlimited praise on Trustpilot, google, Clutch.co."

It promised "50 million residential IPs that will never be blocked", each one "an actual device that acts as a proxy server". The domain was four days old. The same page said: "Trusted by millions of users".

August 2022: the alternative to 911 S5

Within three weeks the pitch changed. From August 14, 2022, the homepage read "The Perfect Alternative to 911 S5" and added: "The Pia S5 is 1:1 compatible with 911 S5 functions and surpasses the 911 S5's Residential Proxy Service."

911 S5 had sold access to home IPs through a Windows program. PIA's page gave the timing: "as of July On the 28th, the 911 S5 was closed." In May 2024 the US Treasury sanctioned three people and three firms tied to it. It called 911 S5 "a residential proxy botnet" run on computers "compromised without the computer owners' knowledge". No record we read ties PIA S5 Proxy to the people behind 911 S5.

By September 2022 the site called itself PIA S5 Proxy, and so did its Windows client. The file names on its download server run from version 1.2.0, built on September 7, 2022, to 2.3.2, built on September 18, 2025. The footer added: "Due to policy, this service is not avaiable in mainland China."

Two press releases followed. The one of September 21, 2022, gave the country as the United States. The one of November 4, 2022, gave the organization as "PIA S5 LLC", also in the United States. OpenCorporates, which copies company registers including those of US states, lists no firm by that name.

On September 27, 2022, the security firm Spur published its own analysis. It found PIA S5 Proxy "while investigating a mobile VPN application called IPChanger". It wrote: "Spur has analyzed a number of PIA's proxy offerings and concluded these devices also belong to the IPIDEA residential proxy network." Google's post of 2026 names Spur among the firms it worked with.

Four Hong Kong firms in three years

The firm named on the site changed more often than its prices. In August and September 2022 the footer read "HONGKONG GUANGLING MDT INFOTECH LIMITED". On October 1, 2022, it read "MARS BROTHERS LIMITED", and on October 19 the first name again. From December 2022 the footer named no one.

The contact page of February 2023 gave Mars Brothers Limited at Suite 603, Hang Pont Commercial Building. In March and April 2023 the same page named "MINGDA INFO TECHNOLOGY LIMITED" at Lucky Centre on Wan Chai Road. The About page of April 2023 said the software was "built by MINGDA INFO TECHNOLOGY LIMITED".

From December 8, 2023, the policies ended with "Company: ROME BELDEN LIMITED". The footer showed it from April 2024. In March 2024 the contact page placed it at Suite 603, the suite the same page had given for Mars Brothers three weeks earlier. From December 2024 to March 2025 the pages switched back to Mars Brothers Limited, one by one. That name stayed until the end, with a second address on Un Chau Street, also in Cheung Sha Wan.

Through all of it the refund, shipping and disclosure policies kept the line "Effective date: July 2022". Hong Kong's register sells company records behind a captcha, so we could not read who owns or directs these firms. OpenCorporates, a copy of the register, lists Hongkong Guangling Mdt InfoTech Limited as company 2746103. It shows no exact entry for the other three.

The trademarks say Mars Brothers

Every mark of the brand that the TMview index lists has one applicant: Mars Brothers Limited, written 火星兄弟有限公司 on the Chinese files.

Three more PIAS5 marks with the words IP ACCESS were filed in China on September 15, 2023, by the same applicant. The US files give Mars Brothers' address as Suite 603, Hang Pont Commercial Building in 2022, and 31 Tonkin Street, Cheung Sha Wan in 2023. The same applicant filed LUNAPROXY in China in October 2022, and LunaProxy in Brazil and Vietnam on April 9, 2024, the day it filed Pias5proxy there. LunaProxy is another brand on Google's list.

Both US files of 2022 give an e-mail address at the domain lingjiangkeji.com. That domain's archived site belongs to 灵匠科技 (LingJiang Tech). Its footer names 徐州灵匠信息科技有限公司南京分公司, a Nanjing branch of a Xuzhou firm, and shows the telecom license number B1.B2-20180513. IPIDEA's own Chinese site showed the same number in 2021, beside the name 江苏艾迪信息科技有限公司. No record we read says how these firms are related.

The Android app was Mars Brothers' too. Google Play's copy of April 2025 shows "PIA VPN: Residential Proxy IP" by MARS BROTHERS LIMITED, with more than 100,000 downloads and a rating of 3.1 from about 1,000 reviews. Its developer contact was PIA's own support address.

From 50 million to 350 million

The pool grew on the homepage, and no record measures it. The page said 50 million IPs in July 2022, 150 million in April 2023 and 350 million from July 2023 to the end.

The price per IP moved the other way. The homepage offered "As low as $0.05/IP" in October 2022, $0.04 in July 2023, $0.045 from July 2024 and $0.03 from December 2025. In December 2025 that headline rate belonged to the largest package. On December 11, 2025, the smallest package was 100 IPs for $18, or $0.18 an IP, and the $0.03 rate needed 100,000 IPs for $3,000.

Plans by the gigabyte first appear in the homepage copy of November 2023, at $0.70, under a menu entry that linked to LunaProxy. From January 2023 to January 2026 the homepage also carried a link to LunaProxy, and LunaProxy's homepage linked back from April 2023 to January 2024. From October 2024 PIA sold its own plan by the gigabyte, at $0.77 and later $0.65.

From January 2025 the homepage said: "Trusted by more than 70,000 worldwide." On where its IPs came from, the About page of April 2023 named "vetted suppliers" who must tell users and "obtain their consent". From October 2024 the homepage said the pool was "ethically sourced from carefully selected partners". No page named a partner, an app or a supplier.

January 2026: Google's list and the end

On January 28, 2026, Google's Threat Intelligence Group published "No Place Like Home Network: Disrupting the World's Largest Residential Proxy Network". It said many well-known residential proxy brands are related to each other and, in its words, "controlled by the actors behind IPIDEA". It listed 13. PIA S5 Proxy, at piaproxy.com, was one. LunaProxy and ABC Proxy were two others.

Google said it "took legal action to take down the domains used to market IPIDEA's products". It said it "partnered with Cloudflare to disrupt IPIDEA's domain resolution". The same post says: "While many residential proxy providers state that they source their IP addresses ethically, our analysis shows these claims are often incorrect or overstated."

The post ends with markers for defenders. It lists eight code-signing identities from five Hong Kong firms, and two belong to MARS BROTHERS LIMITED: one in Kowloon, one in Cheung Sha Wan. The post does not say which files each firm signed.

The shop did not vanish at once. On January 29, 2026, the archive received Cloudflare's warning in its place: "This website has been reported for potentially distributing malware." On January 31 it captured the full homepage and the price list once more, with a "New Year Sale" from $0.65 a gigabyte. Cert Spotter, a log of certificates, lists a new one for the domain and all its sub-addresses, valid from January. 29

From February 7 to March 4 every copy of the download server came back with an error. The registry dates the last change to piaproxy.com to 03:01 UTC on March 5, 2026, and the domain has shown "client hold" since. The record of lunaproxy.com, at the same registrar, changed nine seconds earlier and shows the same status. On October 11, 2026, piaproxy.com gave no DNS answer, and its Android app was gone from Google Play.

Who PIA S5 Proxy is connected to

Our page on who owns your proxy provider maps more groups like this one, and our page on what happened to LunaProxy follows the sister brand.

In court and in filings

PIA S5 Proxy is not a party to any US case we found. CourtListener holds no docket or opinion that names piaproxy, PIA S5, Mars Brothers Limited, Rome Belden, Guangling MDT or Mingda Info Technology.

Google's action runs through Google LLC v. Does 1-25 in the Southern District of New York (1:25-cv-04503). Google filed it on May 30, 2025, against 25 unnamed defendants it accuses of running the BadBox 2.0 botnet. On September 18, 2025, Judge J. Paul Oetken entered a default judgment and a permanent injunction.

On January 27, 2026, Google told the court it would take down more domains under that order. Its public letter says IPIDEA's network "includes at least 19 other purportedly legitimate residential proxy businesses". It adds that these "share account information, name server pairs, corporate records, and web services". Google wrote that it would serve the order on the registrars of domains "that advertise proxy services".

The list of domains is sealed, and the public letter names no brand but IPIDEA. Google amended the list on January 28, February 2 and February 25, 2026. These are a party's statements, in a case decided by default. Whether piaproxy.com is on the sealed list is not public.

What PIA S5 Proxy sold, in short

PIA S5 Proxy sold residential IPs one at a time through its own client, with targeting by country, city and ISP. It added plans by the gigabyte, an unlimited plan billed by the day, static residential IPs and, by December 2025, datacenter proxies. On December 11, 2025, the smallest package was 100 IPs for $18.

The terms were short. The shipping terms, dated "Effective date: July 2022", offered "package plan guarantees within 48 hours of purchase". They ruled out refunds "for various failures that may occur after successful use". A privacy policy of December 2025 added that every user "must undergo static real-name authentication before using our services". Our page on what happened to Piaproxy covers what former customers can still do.

What customers reported over time

The archive kept two copies of its Trustpilot page, two years apart, and the score rose from 3 to 4.1. The Android app went the other way: 5.0 in July 2022, 3.1 by April 2025 with three times as many reviews.

Is PIA S5 Proxy legit?

On the records it was a real business with real software, sold for three and a half years. It held a registered US trademark, an app with more than 100,000 downloads and a price list that changed often.

It was also hard to pin down. Its pages named four Hong Kong firms between 2022 and 2025, none with a register entry we could read in full. Its press releases named a US company that no register we searched lists. Google says the actors behind IPIDEA controlled it, and since March 2026 its domain has been on hold.

If you are looking elsewhere

• If you want a provider outside Google's list of January 28, 2026, leave out its twelve other names too, LunaProxy and ABC Proxy among them. The full list is on our page about Google's action.
• If you buy small amounts, HProxy is not on that list and belongs to no proxy group. One gigabyte of its Residential Lite costs $0.50 per GB, with no plan to sign.
• If you want to check an IP before you trust it, our free proxy checker shows the network it belongs to, with no sign-up.

What we could not find out

1. Who owns Mars Brothers Limited. Hong Kong's register sells its records behind a captcha, and we buy nothing. Google's certificate gives the firm the number 3135905.
2. What the other three firms did. Each was named for months and then dropped, and no page says why.
3. Whether piaproxy.com is on Google's sealed list, and who asked the registry for the hold of March 5, 2026.
4. How LingJiang Tech, IPIDEA's Chinese operator and Mars Brothers relate, beyond one e-mail domain and one license number.
5. Where its IPs came from. Its pages spoke of vetted suppliers and partners, and named none.
6. Who signed its Windows client. Google's list names no PIA file, and we download no rival software.
7. Whether the business goes on under another name.

We bought nothing and tested no PIA S5 Proxy IP: our rule is to read and never to buy. The domain status and the search figures change, and we will read these records again by January 11, 2027.

Sources

• Verisign RDAP and the registrar's RDAP: piaproxy.com, lunaproxy.com, ipchanger.net, pias5proxy.com and lingjiangkeji.com. Read October 10 and 11, 2026.
• Cert Spotter's certificate log: the certificates for piaproxy.com still valid on October 14, 2026.
• Internet Archive: piaproxy.com from 2022 to 2026 (homepage, contact, About, privacy, refund, shipping, disclosure and AML pages, pricing page, download server index), ipchanger.net, lunaproxy.com, abcproxy.com, ipidea.net, ipidea.io, lingjiangkeji.com, the Google Play listing of the PIA app, and the Trustpilot page of piaproxy.com. Read October 10 and 11, 2026.
• TMview (EUIPO and national offices): PIA S5 PROXY, PIA S5, PIAPROXY, PIA PROXY, PIAS5, LUNAPROXY. Read October 11, 2026.
• US Patent and Trademark Office: serials 97533869, 97582284 (registration 7211224), 98284221, 98284235 and 98284260, status pages and prosecution history. Read October 11, 2026.
• Google Threat Intelligence Group, "No Place Like Home Network: Disrupting the World's Largest Residential Proxy Network", January 28, 2026; Google, "Google Threat Intelligence Group shuts down IPIDEA proxy network", January 30, 2026. Read October 11, 2026.
• US courts, through CourtListener: Google LLC v. Does 1-25 (S.D.N.Y. 1:25-cv-04503), the docket and the public letter of January 27, 2026, (ECF 45), from the Internet Archive's copy. Read October 11, 2026.
• US Treasury press release jy2375 of May 28, 2024, on the sanctions tied to the 911 S5 botnet. Read October 11, 2026.
• Spur, "Big Socks to Fill: Tracking the Next 911RE", September 27, 2022, from the Internet Archive's copy. Read October 11, 2026.
• Press releases of PIA S5 Proxy, September 21, 2022, and November 4, 2022, as syndicated by FinancialContent; OpenCorporates searches. Read October 11, 2026.
• Google Ads Keyword Planner and Search Console, our own accounts. Read October 11, 2026.
• Our own checks from the server: DNS of piaproxy.com and pias5proxy.com, the archive's redirect records. October 11, 2026.