PIA S5 Proxy was a residential proxy shop at piaproxy.com, opened in July 2022 and offline since early 2026. Its trademarks, its Android app and its own pages from 2025 name one company: Mars Brothers Limited, a Hong Kong company at 31 Tonkin Street in Cheung Sha Wan. On 28 January 2026 Google listed PIA S5 Proxy among the brands it says are "controlled by the actors behind IPIDEA". Since 5 March 2026 the domain has been on hold. Below is the record in order of date, each fact with the register, archive or filing it comes from.
PIA S5 Proxy at a glance
| what the records show | |
|---|---|
| status | piaproxy.com on client hold since 5 March 2026; no DNS answer on 11 October 2026 |
| earlier names | IPChanger and PIA Proxy Manager (2022) |
| owner of its trademarks | Mars Brothers Limited (火星兄弟有限公司), Hong Kong |
| other firms its pages named | Hongkong Guangling MDT Infotech (2022), Mingda Info Technology (2023), Rome Belden (2023 to 2024) |
| people in charge | none named on any page or record we read |
| address | Suite 603, Hang Pont Commercial Building, 31 Tonkin Street, Cheung Sha Wan |
| domain | registered 21 July 2022; first certificate the next day |
| trademark | PIAS5-PROXY IP ACCESS, US registration 7211224 (2023) |
| pool it claimed | 50 million IPs in 2022, 350 million from July 2023 |
| named on 28 January 2026 among brands of the IPIDEA network | |
| Trustpilot | 4.1 from 177 reviews, archived March 2025 |
We read the records on 10 and 11 October 2026: domain and certificate logs, 290 archived copies of its pages, app store copies and Google's posts from our server in St. Louis, and the trademark and court indexes, which refused that server, from our office.
The story, oldest first
A solid marker is a record we read in a register, an archive, a court file or a dated publication. A hollow marker is what PIA S5 Proxy or its owner said about itself.
An IP changer before a proxy shop
The business is older than its best-known name. A US trademark file records an application by Mars Brothers Limited for PIA PROXY MANAGER, filed on 3 August 2022. It claims first use on 16 December 2021.
The current registration of ipchanger.net dates from 13 April 2022, at the registrar and on the name servers piaproxy.com would later use. On 21 July 2022 it showed a page for "PIA Proxy Manager". A Google Play copy of the next day lists an Android app, "PIA VPN: IP Changer Safe Proxy", by MARS BROTHERS LIMITED. It had more than 10,000 downloads and 321 reviews at 5.0. The developer address read: Suite 603, 6/F, Hang Pont Commercial Building, 31 Tonkin Street.
July 2022: followers, likes and reviews
piaproxy.com was registered on 21 July 2022. Its first certificates were issued the next day, for the shop, a checkout, a download server and an API. The first archived page, of 25 July 2022, sold "PIA Proxy Manager", a "Free Residential Proxy Client".
The page listed what buyers could do with it. "Register accounts in batches", "Add more followers" and "Bulk comments and likes" came first. Another heading read: "Bulk positive reviews: Need lots of positive reviews? Solve IP restrictions and achieve unlimited praise on Trustpilot, google, Clutch.co."
It promised "50 million residential IPs that will never be blocked", each one "an actual device that acts as a proxy server". The domain was four days old. The same page said: "Trusted by millions of users".
August 2022: the alternative to 911 S5
Within three weeks the pitch changed. From 14 August 2022 the homepage read "The Perfect Alternative to 911 S5" and added: "The Pia S5 is 1:1 compatible with 911 S5 functions and surpasses the 911 S5's Residential Proxy Service."
911 S5 had sold access to home IPs through a Windows program. PIA's page gave the timing: "as of July On the 28th, the 911 S5 was closed." In May 2024 the US Treasury sanctioned three people and three firms tied to it. It called 911 S5 "a residential proxy botnet" run on computers "compromised without the computer owners' knowledge". No record we read ties PIA S5 Proxy to the people behind 911 S5.
By September 2022 the site called itself PIA S5 Proxy, and so did its Windows client. The file names on its download server run from version 1.2.0, built on 7 September 2022, to 2.3.2, built on 18 September 2025. The footer added: "Due to policy, this service is not avaiable in mainland China."
Two press releases followed. The one of 21 September 2022 gave the country as the United States. The one of 4 November 2022 gave the organisation as "PIA S5 LLC", also in the United States. OpenCorporates, which copies company registers including those of US states, lists no firm by that name.
On 27 September 2022 the security firm Spur published its own analysis. It found PIA S5 Proxy "while investigating a mobile VPN application called IPChanger". It wrote: "Spur has analyzed a number of PIA's proxy offerings and concluded these devices also belong to the IPIDEA residential proxy network." Google's post of 2026 names Spur among the firms it worked with.
Four Hong Kong firms in three years
The firm named on the site changed more often than its prices. In August and September 2022 the footer read "HONGKONG GUANGLING MDT INFOTECH LIMITED". On 1 October 2022 it read "MARS BROTHERS LIMITED", and on 19 October the first name again. From December 2022 the footer named no one.
The contact page of February 2023 gave Mars Brothers Limited at Suite 603, Hang Pont Commercial Building. In March and April 2023 the same page named "MINGDA INFO TECHNOLOGY LIMITED" at Lucky Centre on Wan Chai Road. The About page of April 2023 said the software was "built by MINGDA INFO TECHNOLOGY LIMITED".
From 8 December 2023 the policies ended with "Company: ROME BELDEN LIMITED". The footer showed it from April 2024. In March 2024 the contact page placed it at Suite 603, the suite the same page had given for Mars Brothers three weeks earlier. From December 2024 to March 2025 the pages switched back to Mars Brothers Limited, one by one. That name stayed until the end, with a second address on Un Chau Street, also in Cheung Sha Wan.
Through all of it the refund, shipping and disclosure policies kept the line "Effective date: July 2022". Hong Kong's register sells company records behind a captcha, so we could not read who owns or directs these firms. OpenCorporates, a copy of the register, lists Hongkong Guangling Mdt InfoTech Limited as company 2746103. It shows no exact entry for the other three.
The trademarks say Mars Brothers
Every mark of the brand that the TMview index lists has one applicant: Mars Brothers Limited, written 火星兄弟有限公司 on the Chinese files.
| mark | office and number | filed, and what happened |
|---|---|---|
| PIA PROXY MANAGER | US 97533869 | 3 Aug 2022; abandoned 23 Aug 2023 |
| PIAS5-PROXY IP ACCESS | US 97582284 | 7 Sep 2022; registered 7 Nov 2023 as 7211224 |
| PIAS5, PIAPROXY, PIAS5PROXY | US, three files | 24 Nov 2023; abandoned 26 Sep 2024 |
| PIAPROXY, PIAS5PROXY, PIAS5 | China, six files | 31 Oct 2023; registered in 2024 |
| Pias5proxy | Brazil, two files | 9 Apr 2024; registered 21 Jan 2026 |
| LUNAPROXY | China, two files | 28 Oct 2022; registered 21 May 2023 |
Three more PIAS5 marks with the words IP ACCESS were filed in China on 15 September 2023, by the same applicant. The US files give Mars Brothers' address as Suite 603, Hang Pont Commercial Building in 2022, and 31 Tonkin Street, Cheung Sha Wan in 2023. The same applicant filed LUNAPROXY in China in October 2022, and LunaProxy in Brazil and Vietnam on 9 April 2024, the day it filed Pias5proxy there. LunaProxy is another brand on Google's list.
Both US files of 2022 give an e-mail address at the domain lingjiangkeji.com. That domain's archived site belongs to 灵匠科技 (LingJiang Tech). Its footer names 徐州灵匠信息科技有限公司南京分公司, a Nanjing branch of a Xuzhou firm, and shows the telecom licence number B1.B2-20180513. IPIDEA's own Chinese site showed the same number in 2021, beside the name 江苏艾迪信息科技有限公司. No record we read says how these firms are related.
The Android app was Mars Brothers' too. Google Play's copy of April 2025 shows "PIA VPN: Residential Proxy IP" by MARS BROTHERS LIMITED, with more than 100,000 downloads and a rating of 3.1 from about 1,000 reviews. Its developer contact was PIA's own support address.
From 50 million to 350 million
The pool grew on the homepage, and no record measures it. The page said 50 million IPs in July 2022, 150 million in April 2023 and 350 million from July 2023 to the end.
The price per IP moved the other way. The homepage offered "As low as $0.05/IP" in October 2022, $0.04 in July 2023, $0.045 from July 2024 and $0.03 from December 2025. In December 2025 that headline rate belonged to the largest package. On 11 December 2025 the smallest package was 100 IPs for $18, or $0.18 an IP, and the $0.03 rate needed 100,000 IPs for $3,000.
Plans by the gigabyte first appear in the homepage copy of November 2023, at $0.70, under a menu entry that linked to LunaProxy. From January 2023 to January 2026 the homepage also carried a link to LunaProxy, and LunaProxy's homepage linked back from April 2023 to January 2024. From October 2024 PIA sold its own plan by the gigabyte, at $0.77 and later $0.65.
From January 2025 the homepage said: "Trusted by more than 70,000 worldwide." On where its IPs came from, the About page of April 2023 named "vetted suppliers" who must tell users and "obtain their consent". From October 2024 the homepage said the pool was "ethically sourced from carefully selected partners". No page named a partner, an app or a supplier.
January 2026: Google's list and the end
On 28 January 2026 Google's Threat Intelligence Group published "No Place Like Home Network: Disrupting the World's Largest Residential Proxy Network". It said many well-known residential proxy brands are related to each other and, in its words, "controlled by the actors behind IPIDEA". It listed 13. PIA S5 Proxy, at piaproxy.com, was one. LunaProxy and ABC Proxy were two others.
Google said it "took legal action to take down the domains used to market IPIDEA's products". It said it "partnered with Cloudflare to disrupt IPIDEA's domain resolution". The same post says: "While many residential proxy providers state that they source their IP addresses ethically, our analysis shows these claims are often incorrect or overstated."
The post ends with markers for defenders. It lists eight code-signing identities from five Hong Kong firms, and two belong to MARS BROTHERS LIMITED: one in Kowloon, one in Cheung Sha Wan. The post does not say which files each firm signed.
The shop did not vanish at once. On 29 January 2026 the archive received Cloudflare's warning in its place: "This website has been reported for potentially distributing malware." On 31 January it captured the full homepage and the price list once more, with a "New Year Sale" from $0.65 a gigabyte. New certificates for the domain were issued on 29 January and 8 February.
From 7 February to 4 March every copy of the download server came back with an error. The registry dates the last change to piaproxy.com to 03:01 UTC on 5 March 2026, and the domain has shown "client hold" since. The record of lunaproxy.com, at the same registrar, changed nine seconds earlier and shows the same status. On 11 October 2026 piaproxy.com gave no DNS answer, and its Android app was gone from Google Play.
Who PIA S5 Proxy is connected to
| connection | what the record shows, and what it does not |
|---|---|
| Mars Brothers Limited | applicant for every PIA mark in TMview, developer of its Android app, the firm its pages named from 2025; Google lists two of its code-signing identities. Not shown: who owns or runs it |
| LunaProxy | the same trademark applicant; links both ways between the two homepages; the same registrar and name servers, on hold nine seconds apart; on Google's list. Not shown: who ran it day to day |
| IPIDEA | Google (2026) says its actors control PIA S5 Proxy; Spur (2022) said PIA's proxies belonged to its network. Not shown: a shared owner on any register we could read |
| Hongkong Guangling MDT Infotech | named in the footers of PIA S5 Proxy (2022), LunaProxy (2022) and ABC Proxy (2023); OpenCorporates lists it as 2746103. Not shown: what it did for them |
| Rome Belden Limited | PIA's company line from December 2023 to December 2024, at Mars Brothers' suite; hidden in the code of LunaProxy's homepage from 2023 to 2026. Not shown: anything more |
| Mingda Info Technology | named as the maker of the software in 2023. Not shown: a register entry |
| ABC Proxy | its homepage of July 2023 carried MARS BROTHERS LIMITED in hidden code and the Guangling name in its footer; on Google's list. Not shown: a shared owner |
| LingJiang Tech | the e-mail domain of the 2022 US files; its licence number also appeared on IPIDEA's Chinese site. Not shown: how they relate |
| 911 S5 | PIA's pages called it "The Perfect Alternative to 911 S5". Not shown: any tie to the people behind 911 S5 |
| Cloudflare | served the site; showed a malware warning on 29 January 2026. Not shown: who reported it |
| Private Internet Access | no link: a VPN sold by Private Internet Access, Inc. Not shown: anything but a shared PIA |
Our page on who owns your proxy provider maps more groups like this one, and our page on what happened to LunaProxy follows the sister brand.
In court and in filings
PIA S5 Proxy is not a party to any US case we found. CourtListener holds no docket or opinion that names piaproxy, PIA S5, Mars Brothers Limited, Rome Belden, Guangling MDT or Mingda Info Technology.
Google's action runs through Google LLC v. Does 1-25 in the Southern District of New York (1:25-cv-04503). Google filed it on 30 May 2025 against 25 unnamed defendants it accuses of running the BadBox 2.0 botnet. On 18 September 2025 Judge J. Paul Oetken entered a default judgment and a permanent injunction.
On 27 January 2026 Google told the court it would take down more domains under that order. Its public letter says IPIDEA's network "includes at least 19 other purportedly legitimate residential proxy businesses". It adds that these "share account information, name server pairs, corporate records, and web services". Google wrote that it would serve the order on the registrars of domains "that advertise proxy services".
The list of domains is sealed, and the public letter names no brand but IPIDEA. Google amended the list on 28 January, 2 February and 25 February 2026. These are a party's statements, in a case decided by default. Whether piaproxy.com is on the sealed list is not public.
What PIA S5 Proxy sold, in short
PIA S5 Proxy sold residential IPs one at a time through its own client, with targeting by country, city and ISP. It added plans by the gigabyte, an unlimited plan billed by the day, static residential IPs and, by December 2025, datacenter proxies. On 11 December 2025 the smallest package was 100 IPs for $18.
The terms were short. The shipping terms, dated "Effective date: July 2022", offered "package plan guarantees within 48 hours of purchase". They ruled out refunds "for various failures that may occur after successful use". A privacy policy of December 2025 added that every user "must undergo static real-name authentication before using our services". Our page on what happened to Piaproxy covers what former customers can still do.
What customers reported over time
| archived | rating | reviews |
|---|---|---|
| Trustpilot, March 2023 | 3 | 28 |
| Trustpilot, March 2025 | 4.1 | 177 |
| Android app, July 2022 | 5.0 | 321 |
| Android app, April 2025 | 3.1 | 1.02K |
The archive kept two copies of its Trustpilot page, two years apart, and the score rose from 3 to 4.1. The Android app went the other way: 5.0 in July 2022, 3.1 by April 2025 with three times as many reviews.
Is PIA S5 Proxy legit?
On the records it was a real business with real software, sold for three and a half years. It held a registered US trademark, an app with more than 100,000 downloads and a price list that changed often.
It was also hard to pin down. Its pages named four Hong Kong firms between 2022 and 2025, none with a register entry we could read in full. Its press releases named a US company that no register we searched lists. Google says the actors behind IPIDEA controlled it, and since March 2026 its domain has been on hold.
If you are looking elsewhere
- If you want a provider outside Google's list of 28 January 2026, leave out its twelve other names too, LunaProxy and ABC Proxy among them. The full list is on our page about Google's action.
- If you buy small amounts, HProxy is not on that list and belongs to no proxy group. One gigabyte of its Residential Lite costs $0.50 per GB, with no plan to sign.
- If you want to check an IP before you trust it, our free proxy checker shows the network it belongs to, with no sign-up.
What we could not find out
- Who owns Mars Brothers Limited. Hong Kong's register sells its records behind a captcha, and we buy nothing. Google's certificate gives the firm the number 3135905.
- What the other three firms did. Each was named for months and then dropped, and no page says why.
- Whether piaproxy.com is on Google's sealed list, and who asked the registry for the hold of 5 March 2026.
- How LingJiang Tech, IPIDEA's Chinese operator and Mars Brothers relate, beyond one e-mail domain and one licence number.
- Where its IPs came from. Its pages spoke of vetted suppliers and partners, and named none.
- Who signed its Windows client. Google's list names no PIA file, and we download no rival software.
- Whether the business goes on under another name.
We bought nothing and tested no PIA S5 Proxy IP: our rule is to read and never to buy. The domain status and the search figures change, and we will read these records again by 11 January 2027.
Sources
- Verisign RDAP and the registrar's RDAP: piaproxy.com, lunaproxy.com, ipchanger.net, pias5proxy.com and lingjiangkeji.com. Read 10 and 11 October 2026.
- Certificate logs (crt.sh): piaproxy.com and pias5proxy.com. Read 10 October 2026.
- Internet Archive: piaproxy.com from 2022 to 2026 (homepage, contact, About, privacy, refund, shipping, disclosure and AML pages, pricing page, download server index), ipchanger.net, lunaproxy.com, abcproxy.com, ipidea.net, ipidea.io, lingjiangkeji.com, the Google Play listing of the PIA app, and the Trustpilot page of piaproxy.com. Read 10 and 11 October 2026.
- TMview (EUIPO and national offices): PIA S5 PROXY, PIA S5, PIAPROXY, PIA PROXY, PIAS5, LUNAPROXY. Read 11 October 2026.
- US Patent and Trademark Office: serials 97533869, 97582284 (registration 7211224), 98284221, 98284235 and 98284260, status pages and prosecution history. Read 11 October 2026.
- Google Threat Intelligence Group, "No Place Like Home Network: Disrupting the World's Largest Residential Proxy Network", 28 January 2026; Google, "Google Threat Intelligence Group shuts down IPIDEA proxy network", 30 January 2026. Read 11 October 2026.
- US courts, through CourtListener: Google LLC v. Does 1-25 (S.D.N.Y. 1:25-cv-04503), the docket and the public letter of 27 January 2026 (ECF 45), from the Internet Archive's copy. Read 11 October 2026.
- US Treasury press release jy2375 of 28 May 2024, on the sanctions tied to the 911 S5 botnet. Read 11 October 2026.
- Spur, "Big Socks to Fill: Tracking the Next 911RE", 27 September 2022, from the Internet Archive's copy. Read 11 October 2026.
- Press releases of PIA S5 Proxy, 21 September 2022 and 4 November 2022, as syndicated by FinancialContent; OpenCorporates searches. Read 11 October 2026.
- Google Ads Keyword Planner and Search Console, our own accounts. Read 11 October 2026.
- Our own checks from the server: DNS of piaproxy.com and pias5proxy.com, the archive's redirect records. 11 October 2026.
