Thordata Says It Started in 2018. Its Own Paperwork Says 2023.

Shop for cheap residential proxies in 2026 and Thordata will find you fast: aggressive discount codes, a 100 million IP pool, and a founding date of 2018 stamped across its website and its press releases. That last detail is the one that does not survive a look at the public record. The company that actually owns the Thordata trademark was incorporated in Hong Kong in September 2023. On its own United States trademark application, Thordata swore under oath that it first used the brand in commerce in January 2025. There is no version of "founded 2018" that agrees with the paperwork Thordata filed itself.

We run a competing proxy network and we track the lineage of every rival in it, the same way we did for the Tesonet ownership map and the Microleaves-to-Shifter rebrand. Origin is a real spec, not gossip: a provider that overstates its own age by seven years is a provider you should ask harder questions of, because the thing an inflated track record usually hides is a missing one. Here is the sourced timeline, what the legal records actually show, and the infrastructure detail that puts Thordata one netblock away from a network Google took down in January. We will be clear about what is proven and what is only circumstantial, because most of this is circumstantial, and saying so is the point.

The five founding dates that do not agree

Pin down when Thordata started and you get five different answers depending on which document you read. Two of them are marketing. Three of them are legal records the company or a government office created, and those three cluster in a completely different window from the marketing.

Look at the shape of that. The two dates that put Thordata in 2018 or 2020 are the ones a company writes about itself, on pages a company controls. Every date that a neutral party recorded, a government registry or a sworn filing, lands in the September 2023 to July 2025 window. When the self-reported history and the paper trail disagree by five to seven years, the paper trail is the one that was made under penalty of something.

What the paperwork actually shows

Start with the company itself. There is no "Thordata Inc." The brand is owned and operated by HK Hengsheng Runzhi Technology Co., Limited (Chinese name 香港恒升潤智科技有限公司), a private company limited by shares. Its Hong Kong Companies Registry record is unambiguous: registry number 3318438, business registration number 75712903, incorporated September 14, 2023, status live, registered office at Unit 29, 13th Floor, Fook Cheong Building, 63 Hoi Yuen Road, Kwun Tong, Kowloon. Its first annual return was filed in September 2025. A company cannot have been operating a global proxy network since 2018 under a legal entity that did not exist until late 2023.

Then the trademark, which is the more damning document because Thordata wrote it. On July 10, 2025, HK Hengsheng Runzhi filed US trademark application serial number 99278000 for the mark THORDATA with the United States Patent and Trademark Office (USPTO, the federal office that registers brand names). On that application, the applicant states a "first use in commerce" date. For THORDATA, that date is January 11, 2025. First use in commerce is a legal claim about the earliest the mark was actually used to sell something, and applicants swear to it. Thordata's own lawyer put January 2025 on the record. That is not a date a company founded in 2018 files.

One odd detail in the filing is worth flagging, because it does not fit a plain proxy business. The trademark's list of services, alongside the expected "rental of web servers" and "data security consultancy," includes "user authentication services using blockchain-based software technology for cryptocurrency transactions." That is an unusual thing for a proxy seller to reserve, and it hints at product plans (or a template) beyond proxies. We are not going to read too much into one clause, but it is there.

A domain older than the brand

If the "2018" claim cannot rest on the company or the trademark, the last place it might hide is the domain name. It does not hide there either, and the reason is almost funny.

The public WHOIS record (the registration record every domain carries) shows thordata.com was first created on March 23, 2001. That is a genuinely old domain, but it is old for the wrong reason. It was registered twenty-four years ago by some unrelated party, dropped at some point, and picked up later by the current operator through the aftermarket. You can tell because the registrar of record is Aceville Pte. Ltd., a Singapore budget registrar, not the kind of continuous 2001-to-now registration a two-decade-old business would show. Buying an aged, brandable domain is a completely normal and legal thing to do. It is just not evidence of a 2018 origin, and a company that genuinely started in 2018 would not need to.

The infrastructure that actually serves Thordata's proxies tells the real build date. The gateway domain, thordata.net, had operational subdomains stood up in November 2024 (the get-ip.thordata.net utility subdomain was registered November 8, 2024). Thordata launched on Product Hunt on December 26, 2025, and issued its "global expansion" press release on January 13, 2026. A brand does not build out its production gateway in late 2024, file its first-use date as January 2025, and debut on Product Hunt at the end of 2025 if it has been running since 2018. It does all of that if it launched, as the records say, around the start of 2025.

The gateway sits in the same netblock as IPIDEA

Here is where the story stops being about a fudged founding date and starts being about who Thordata might actually be. This is the most serious claim in the piece, so it is also the one we will hedge the hardest.

On January 28, 2026, Google's Threat Intelligence Group announced it had disrupted IPIDEA, which it called one of the largest residential proxy networks in the world. Google's investigation found the network was run by a single group based in China, incorporated through Hong Kong entities, operating at least 13 proxy and VPN brands through shared infrastructure: 360 Proxy, 922 Proxy, ABC Proxy, Cherry Proxy, IP2World, LunaProxy, PIA S5 Proxy, PyProxy, TabProxy, Door VPN, Galleon VPN, Radish VPN, and IPidea itself. In one seven-day window, Google counted more than 550 distinct threat groups (including state-linked actors from China, North Korea, Iran, and Russia) routing through IPIDEA exit nodes. The pool was built in part through software development kits (SDKs, code packages quietly bundled into apps) that turned devices into proxy exit nodes.

In its published technical detail, Google included a sample response from one of IPIDEA's control servers, the machines that hand out proxy nodes to customers. That sample lists specific node addresses. One of them is 49.51.68.143. That IP is confirmed, in Google's own blog, as part of IPIDEA's infrastructure.

Now hold that next to Thordata. Our research dossier resolved Thordata's primary proxy gateway, t.pr.thordata.net, to 49.51.189.254 in April 2026. Both addresses fall inside the same block.

The block is 49.51.0.0/16, and a WHOIS and Autonomous System Number lookup (an ASN is the identifier internet routing uses for a network operator) attributes it to AS132203, Tencent Cloud. So Thordata's gateway and an IP Google published as IPIDEA infrastructure live in the same /16 on the same Chinese cloud provider.

Read that carefully, because it is easy to oversell. A /16 holds 65,536 addresses, and Tencent Cloud is a large public cloud that rents to thousands of legitimate businesses. Two IPs sharing a /16 there is co-location, not a shared control plane. It is a signal, not a smoking gun, and anyone who tells you it proves Thordata is IPIDEA is overreaching. What it does establish, combined with the rest, is that Thordata is not a Western enterprise it presents itself as: its mail server (43.130.163.51) also sits on Tencent Cloud, and its .cn domain runs on Alibaba Cloud DNS. The technical footprint is decisively Chinese cloud, behind a Hong Kong shell and a Dover, Delaware mailing address. That part is not circumstantial at all.

The pattern, and where it stays only a pattern

One coincidence is nothing. The reason this one is worth writing up is that Thordata matches, point for point, a template the industry has already documented, the one Google described when it took down IPIDEA and the one the proxy-benchmarking site Proxyway flagged as a "wave" of look-alike Hong Kong providers that appeared between 2022 and 2024. Each of these on its own is weak. Stacked, they stop looking like accidents.

• It is sold next to confirmed IPIDEA brands. The reseller TradeProxy.net carries Thordata alongside 922Proxy, LunaProxy, PiaProxy, and ABCProxy, four brands Google named as IPIDEA. Resellers carry many unrelated brands, so this is suggestive, not conclusive. It is still a strange shelf to share.
• Its integrations point at multi-accounting, not enterprise AI. Thordata's deepest partnerships are with antidetect browsers (BitBrowser, Octobrowser, AdsPower, GoLogin, Hidemium, Undetectable), tools whose main use is running many accounts that are not supposed to look connected. That is a customer base of sneaker and marketplace multi-accounting, which does not match the "enterprise AI data pipeline" story the homepage tells.
• Its reputation signals are thin or scrubbed. Trustpilot pulled Thordata's rating for "a breach of Trustpilot guidelines" after removing fake reviews. On G2 it has 2.5 out of 5 from two reviews. Proxyway, which benchmarks 30-plus providers including small ones, does not cover Thordata at all. For a brand claiming 4,000-plus enterprise customers, that is a strange absence.
• Its own numbers do not reconcile. The company's public figures contradict each other depending on the page.

Here is that last point laid out, because a company's story is easiest to check against itself.

None of these rows alone convicts anyone. Companies do use registered-agent addresses, self-reported headcounts drift, and pool sizes get rounded up across the whole industry. But every discrepancy runs the same direction: bigger, older, and more American than the records support. That is not the error pattern of an honest rounding. It is the error pattern of a story.

The honest verdict

Here is where we land, split cleanly into what the documents prove and what they only suggest, because that line is the whole value of an article like this.

What is proven, from primary records: Thordata's legal entity was incorporated in Hong Kong on September 14, 2023. Thordata's own US trademark puts its first commercial use at January 11, 2025. No primary record anywhere supports a 2018 or 2020 founding. Thordata's own gateway, mail, and DNS infrastructure sit on Chinese cloud (Tencent and Alibaba), behind a Hong Kong entity and a Delaware mailing address. And one IP that Google published as IPIDEA infrastructure shares a /16 netblock with Thordata's gateway.

What is inferred, and stays inferred: that Thordata is an IPIDEA reseller, a sister brand, or a parallel operator running the same playbook. The circumstantial case for it is strong (the shared netblock, the shared reseller shelf, the antidetect customer base, the Hong Kong shell wave, the launch timed to the exact window IPIDEA was being taken down), but Google did not name Thordata, and its list, though "non-exhaustive," did not include it. We are not telling you Thordata is IPIDEA. We are telling you the "2018" origin story is false on the company's own paperwork, the operation is a Chinese-run brand that went to market around January 2025, and it sits close enough to a network Google dismantled that the sourcing question is not optional.

The founder question ends the same way. Public materials name only "Kevin," and the Product Hunt handle @cao_kevin suggests a surname of Cao, a Chinese name consistent with everything else. We could not verify who that is, and a first-name-only founder for a "4,000-enterprise" company is itself part of the pattern.

What this means when you buy

The reason a founding date matters is not pedantry. In residential proxies, the only spec that truly decides your exposure is how the pool was sourced, and sourcing is exactly what a provider with a fabricated history is least able to answer. We walked through the worst case in full in the NetNut botnet takedown, where a Nasdaq-listed company's residential pool was tied to two million hijacked smart TVs, and the whole IPIDEA action Google took is the same story at a larger scale. When a brand cannot tell you the truth about the year it started, treating its "ethically sourced" label as fact is a leap you have no reason to make.

So judge the sourcing, not the logo, and verify the IPs instead of trusting the badge. Our how to vet a proxy provider guide is the checklist for doing exactly that. If you ever want to see what network an IP actually belongs to, our free proxy checker makes a real connection through a proxy and reports the exit location, the anonymity grade, and the network behind the address, so a Tencent-hosted node wearing a "US residential" label gets caught on the spot.

We built HProxy on the opposite bet from Thordata: that being plainly answerable about who we are and where our IPs come from is worth more than a flattering origin story. We are independent, not part of any larger proxy or VPN group, our residential proxies are $0.65/GB pay as you go with no know-your-customer checks and a balance that never expires, and you can inspect the network yourself with the free proxy checker and the live free proxy list before you trust a word of this. The company you should worry about is the one whose own trademark contradicts its homepage.

Sources

• Hong Kong Companies Registry, record for HK Hengsheng Runzhi Technology Co., Limited (registry number 3318438, incorporated 14 September 2023), via ltddir.com (incorporation date, entity type, registered office, Chinese name)
• USPTO / Trademark record, THORDATA, serial number 99278000, owner HK Hengsheng Runzhi Technology Co., Limited: uspto.report and Trademark Elite (filing date 10 July 2025; first use in commerce 11 January 2025; class 042 services list)
• Google Cloud Threat Intelligence Group, "Disrupting the World's Largest Residential Proxy Network" (28 January 2026; IPIDEA disruption, 13 named brands, 550+ threat groups, sample control-server response listing node 49.51.68.143)
• Google, "Google Threat Intelligence Group shuts down IPIDEA proxy network" (China-based operator incorporated through Hong Kong entities)
• Clutch.co, HK Hengsheng Runzhi Technology Co., Limited profile (conflicting 2020 founding date, employee band)
• FinanceWire, "Thordata Expands Global Residential Proxy Network to Support AI Data Access" (13 January 2026 press release; 60M IP claim, 2018 positioning)
• Product Hunt, Thordata launch (launched 26 December 2025; founder handle @cao_kevin)
• HProxy competitor research dossier, Thordata deep-dive (24 April 2026): WHOIS creation date of thordata.com (23 March 2001), gateway resolution t.pr.thordata.net to 49.51.189.254, Tencent Cloud mail (43.130.163.51) and Alibaba Cloud .cn DNS, antidetect-browser integrations, TradeProxy reseller relationship, Trustpilot enforcement and review-aggregator ratings, and the AS132203 / 49.51.0.0/16 attribution of both IP addresses