What Happened to 911 S5 (911.re)? The Proxy Botnet, Its Takedown and the Case Today

911 S5 was a residential proxy service, sold as 911 or 911.re from 2014, that the U.S. says ran on infected home PCs. By the DOJ's count, its operator spread malware to millions of Windows PCs and sold access to more than 19 million IPs. It went offline in July 2022, came back as Cloudrouter in October 2023, and was dismantled in May 2024. Its operator, YunHe Wang, was arrested in Singapore and is fighting extradition to the United States.

People still search for it: "911 proxy" still draws more than 4,000 searches a month. Below is what the official record says, where the case stands, who uses the name now, and how to check whether a PC was part of the network.

What was 911 S5?

To its buyers, 911 S5 looked like an ordinary residential proxy service. They paid, downloaded a Windows app, and sent traffic out through home IPs in almost any country.

The DOJ describes what sat behind it. Its release of May 29, 2024 says the devices "were associated with more than 19 million unique IP addresses, including 613,841 IP addresses located in the United States". The operator ran about 150 servers around the world, 76 of them leased from U.S. providers. From 2018 until July 2022, he received about $99 million from selling the access. FBI Director Christopher Wray called it "likely the world's largest botnet ever".

The people whose PCs carried that traffic did not know. Each one became an exit for strangers, under their own home address.

How did it get its addresses?

Through software people chose to put on their PCs. The FBI names six free VPN apps that connected a computer to 911 S5: MaskVPN, DewVPN, PaladinVPN, ProxyGate, ShieldVPN and ShineVPN. The DOJ adds that the operator ran some of them himself, and that "pay-per-install services" bundled the malware with "pirated versions of licensed software".

What was it used for?

Crime, in the U.S. account. Attorney General Merrick Garland listed "cyber-attacks, large-scale fraud, child exploitation, harassment, bomb threats, and export violations". The DOJ gives two figures from pandemic relief alone:

• Unemployment insurance: about 560,000 fraudulent claims came from the network's addresses, with "a confirmed fraudulent loss exceeding $5.9 billion".
• Disaster loans: more than 47,000 Economic Injury Disaster Loan applications came from addresses it had compromised.

A home address is the reason buyers paid for it. Fraud checks treat an ordinary household connection with less suspicion than a server, and that is what 911 S5 rented out.

How was it taken down?

Police in the United States, Singapore, Thailand and Germany ran the operation together, by the DOJ's account. They searched homes and seized assets worth about $30 million, with about $30 million more identified for forfeiture, and seized 23 domains. The case sits in the Eastern District of Texas. Wang faces counts of computer fraud, conspiracy to commit wire fraud and conspiracy to commit money laundering, with "a maximum penalty of 65 years in prison" if convicted on all of them.

The Treasury acted a day before the announcement. On May 28, 2024, it designated Wang and two associates, Jingping Liu and Yanni Zheng, and three firms it says he owned or controlled: Spicy Code Company Limited, Tulip Biz Pattaya Group Company Limited and Lily Suites Company Limited.

Where does the case stand?

Still in Singapore. Wang has fought extradition: The Straits Times reported on June 12, 2024 that it was "the third time" he had refused, under a treaty between the two countries. On January 16, 2026, CNA reported that the High Court there had rejected his applications to have items the police seized declared "unlawfully" taken. He was still held there and wanted in the United States.

We found no report of his extradition, a trial or a plea as of October 23, 2026. The charges stay unproven until a court rules on them.

Who uses the 911 name today?

The searches outlived the service. Google's Keyword Planner shows them falling, though still above 4,000 a month:

Those searches now land on other sites. On October 23, 2026, seven of the top ten Google results for "911 proxy" belonged to 911proxy.com, a seller of residential proxies under the 911 name. Its homepage advertised "90M+" residential IPs from $0.80 per GB. The government documents we read concern 911 S5 and Cloudrouter, and none of them mentions 911proxy.com. We found no source that connects the two, so we make no claim either way.

How do you check whether a PC was part of it?

The FBI published steps for Windows, which HKCERT and a security firm's blog repeat:

1. Look for the processes. Open Task Manager and check the Processes tab for mask_svc.exe (MaskVPN), dew_svc.exe (DewVPN), pldsvc.exe (PaladinVPN), proxygate.exe or cloud.exe (ProxyGate), shieldsvc.exe (ShieldVPN) and shsvc.exe (ShineVPN).
2. Search the Start menu for the six names, in case the app is there but not running.
3. Uninstall it, from the app's own Start menu folder or from Add or remove programs.
4. Check again. If a process still runs, select it in Task Manager and choose End task.
5. Scan the PC with up-to-date security software.

The FBI also advises firms that let staff bring their own devices to have those devices checked.

What does 911 S5 teach a residential proxy buyer?

That the label says nothing about how the IPs reached the network. 911 S5 sold "residential proxies" like any other seller, and buyers saw home IPs in many countries. The difference sat in the software on the victims' PCs.

Three habits help:

• Ask the seller how its IPs reach its network, and read the answer closely.
• Be wary of free VPNs and free residential proxies. Free software that turns a PC into an exit is how 911 S5 grew. Our pages on free residential proxies and whether free proxies are safe go further.
• Check an address before you trust it. Our proxy checker connects through a proxy and reports the network the address belongs to. How websites detect proxies explains what sites look at.

We sell residential proxies ourselves, at $0.50/GB for one GB, falling to $0.44/GB at 2,000 GB+. Put the questions above to us as well. Who owns your proxy provider maps the firms behind many brands.

What this page could not check

• We tested nothing: no app, no address and no site using the 911 name.
• The FBI's removal page and KrebsOnSecurity refused our reader, so the removal steps come from the FBI's notice as HKCERT and Malwarebytes quote it, and the history from the government releases.
• The figures are claims and estimates from an indictment and official releases. No court has ruled on the charges.
• We found no source tying 911proxy.com to the original service, and we make no claim about it beyond what its own homepage says.
• The case continues. We will check this page again by January 23, 2027.

Sources

• U.S. Department of Justice, release on the 911 S5 botnet, May 29, 2024, read through the DOJ's press API on October 23, 2026.
• DOJ, CCIPS, fact sheet, read October 23, 2026.
• FBI, IC3, notice PSA240529 on 911 S5, May 29, 2024.
• U.S. Treasury, sanctions release jy2375, May 28, 2024.
• U.S. State Department, statement on the 911 S5 network, May 28, 2024.
• The Straits Times, report on the hearing, June 12, 2024.
• CNA, report on the High Court ruling, January 16, 2026.
• The Record, report on the takedown, May 29, 2024.
• HKCERT, post on 911 S5 and its removal, October 28, 2024.
• Malwarebytes, how to tell if a VPN app added your PC to a botnet, May 31, 2024.
• Google Ads Keyword Planner, "911 proxy" terms, read October 23, 2026; Google results for "911 proxy", read the same day.