Dutch National Police, the Public Prosecutor’s Office and the Shadowserver Foundation have dismantled a malicious proxy service that ran on 178,000 infected devices, mostly in private homes and businesses. Police announced the action on October 12, and more servers are to follow.
Servers at Multiple Hosting Providers Taken Down Last Week
According to the Dutch National Police press release, servers at multiple hosting providers were taken offline during the week before the announcement. The service’s website now displays a takedown splash page. Police said additional servers are still to be taken down.
The infection method used to compromise the devices was not disclosed. The announcement describes the 178,000 devices as mostly located in private homes and businesses.
How the Proxy Service Turned Victims’ IP Addresses Into Cover for Criminals
A malicious proxy network lets criminals route their traffic through the internet connections of infected devices. To outside observers, that traffic appears to come from ordinary home and business addresses. A side effect for the owners is that they risk being wrongly flagged as the source of criminal activity that actually came from someone else using their connection.
The takedown stops the laundering of criminal traffic through residential IP addresses for the servers that were dismantled.
The scale matters for how such services work. With 178,000 devices available, an operator can offer customers a large pool of addresses that look like ordinary households and small businesses, which makes the traffic harder to separate from legitimate use. The devices sit in private homes and businesses, so their owners may have had no idea their connections were being used this way. That is the reason the wrongful-flagging risk is more than a technicality for the people involved.
Shadowserver Foundation Joins Dutch Authorities in the Operation
The Shadowserver Foundation took part alongside the National Police and the Public Prosecutor’s Office. The announcement does not describe each partner’s role in detail. It confirms the three bodies acted together to take the service down.
Follow-Up Takedowns Planned After the First Wave
The police statement indicates the operation is not complete. Servers beyond those already seized are to be taken down, so the infrastructure behind the 178,000-device network may not be fully removed yet. The report does not say how many servers remain or when further action will occur.
Public detail on the operation is thin. The announcement does not name the service, describe the malware or flaw that compromised the devices, or say who ran it. What it does establish is the combination of partners: a national police force, prosecutors and a nonprofit that tracks malicious infrastructure working on the same takedown, with the servers spread across multiple hosting providers rather than a single data center.
Second Large Proxy Takedown by Dutch Police in 2026
Earlier in 2026, Dutch police and the FBI took down SocksEscort, a proxy network that covered 369,000 routers and devices. The new operation is smaller than SocksEscort by device count, but it follows the same pattern of authorities targeting residential proxy services that rely on compromised consumer and business hardware.
The police press release says only that the servers went offline last week, without giving an exact date. The announcement also leaves several questions unanswered: how the devices were infected, who operated the service, and whether arrests are expected. The two takedowns in one year show Dutch police returning to the same type of target. Those missing details would determine whether the takedown prevents a rebuild of the network or only interrupts it, and police have said more servers are still to come down, so the Shadowserver-backed action may not be finished.
