Once notorious for launching some of the year's most devastating distributed denial-of-service attacks, Aisuru has undergone a strategic transformation. The botnet's operators now focus on a quieter but more profitable venture: leasing hundreds of thousands of infected Internet of Things devices to proxy services that mask malicious traffic as ordinary user connections. Security researchers note that this shift, combined with a flood of proxies from competing botnets, is accelerating large-scale content harvesting operations tied to artificial intelligence initiatives, allowing data scrapers to evade detection by routing requests through residential connections.
Aisuru emerged in August 2024 and has since infiltrated at least 700,000 IoT systems, including poorly configured routers and security cameras. The botnet's operators initially leveraged this infrastructure for high-profile DDoS campaigns. In June, Aisuru struck KrebsOnSecurity.com with a 6.3 terabit-per-second attack—the largest Google had mitigated at that time. Over subsequent weeks and months, the botnet demonstrated capabilities exceeding 30 terabits per second, surpassing the mitigation capacity of most online targets.
The assault has proven particularly disruptive for U.S. Internet service providers, especially after Aisuru gained control of substantial numbers of IoT devices domestically. When attacks originate from infected systems on these networks, the sheer volume of outgoing traffic frequently disrupts or degrades service for legitimate customers sharing the same infrastructure. Roland Dobbins, principal engineer at Netscout, documented the operational toll: "Multiple broadband access network operators have experienced significant operational impact due to outbound DDoS attacks in excess of 1.5Tb/sec launched from Aisuru botnet nodes residing on end-customer premises. Outbound/crossbound attack traffic exceeding 1Tb/sec from compromised customer premise equipment (CPE) devices has caused significant disruption to wireline and wireless broadband access networks. High-throughput attacks have caused chassis-based router line card failures."
The relentless attacks have drawn scrutiny from federal authorities in the United States and Europe, where many victims operate. Recently, major ISPs have begun informally exchanging block lists to track the constantly shifting command-and-control servers managing the botnet's operations.
Aisuru's operators have recently modified their malware to facilitate easier rental of compromised devices to residential proxy providers. These services enable paying customers to route their internet traffic through third-party devices, offering anonymity and the appearance of legitimate user activity from virtually any major global city. From a website's vantage point, traffic from a residential proxy customer appears to originate from the rented residential address rather than the actual source. While legitimate applications exist—price monitoring and competitive intelligence—these services face widespread abuse for concealing criminal activity including advertising fraud and credential stuffing. The anonymity they provide makes tracing malicious traffic to its origin substantially more difficult.
The proxy industry is increasingly oriented toward enabling aggressive content scraping that feeds raw data into large language models supporting various AI ventures.
'INSANE' GROWTH
Riley Kilmer, co-founder of spur.us, a service monitoring proxy networks, reports extraordinary expansion across leading proxy providers over the past six months. "I just checked, and in the last 90 days we've seen 250 million unique residential proxy IPs," Kilmer stated. "That is insane. That is so high of a number, it's unheard of. These proxies are absolutely everywhere now."
Spur currently tracks an unprecedented surge in available proxies across all major providers:
- LUMINATI_PROXY: 11,856,421
- NETNUT_PROXY: 10,982,458
- ABCPROXY_PROXY: 9,294,419
- OXYLABS_PROXY: 6,754,790
- IPIDEA_PROXY: 3,209,313
- EARNFM_PROXY: 2,659,913
- NODEMAVEN_PROXY: 2,627,851
- INFATICA_PROXY: 2,335,194
- IPROYAL_PROXY: 2,032,027
- YILU_PROXY: 1,549,155
When asked about the rapid growth in its proxy footprint, Oxylabs—ranking fourth on Spur's list—disputed the figures. "We don't systematically track other providers' figures, and we're not aware of any instances of 10× or 100× growth, especially when it comes to a few bigger companies that are legitimate businesses," the company stated.
Bright Data, formerly operating as Luminati Networks and currently topping Spur's rankings, similarly contested the accuracy of Spur's estimates. Rony Shalit, Bright Data's chief compliance and ethics officer, remarked: "We did not actively initiate nor do we see any 10x or 100x expansion of our network, which leads me to believe that someone might be presenting these IPs as Bright Data's in some way. In many cases in the past, due to us being the leading data collection proxy provider, IPs were falsely tagged as being part of our network, or while being used by other proxy providers for malicious activity." Shalit added: "Our network is only sourced from verified IP providers and a robust opt-in only residential peers, which we work hard and in complete transparency to obtain. Every DC, ISP or SDK partner is reviewed and approved, and every residential peer must actively opt in to be part of our network."
HK NETWORK
Spur itself acknowledges that Luminati and Oxylabs stand apart from most competitors on its list, as both enforce know-your-customer protocols—including video verification of all clients—and strictly prohibit customer reselling.
Benjamin Brundage, founder of Synthient, a startup detecting proxy networks, attributes growing confusion about which services pose the greatest risk to the fact that nearly all lesser-known proxy operators have evolved into complex bandwidth resellers. Additionally, some providers have taken aggressive countermeasures against systems scanning for residential proxy nodes. Brundage explained that most proxy services now distribute software development kits that app developers can integrate into their code to generate revenue. These SDKs silently reconfigure user devices to redirect a portion of their bandwidth to proxy service customers.
"Proxy providers have pools of constantly churning IP addresses," Brundage noted. "These IP addresses are sourced through various means, such as bandwidth-sharing apps, botnets, Android SDKs, and more. These providers will often either directly approach resellers or offer a reseller program that allows users to resell bandwidth through their platform."
Although many SDK vendors claim to require explicit user consent before installation, these agreements may constitute mere formality for botnet operators like Aisuru's controllers, who can earn commissions each time an infected device is forced to install an SDK enabling one or more proxy services. A single provider may operate hundreds of distinct proxy pools simultaneously through various sourcing methods, Brundage noted. "Often, you'll see resellers maintaining their own proxy pool in addition to an upstream provider," he explained. "It allows them to market a proxy pool to high-value clients and offer an unlimited bandwidth plan for cheap to reduce their own costs."
Certain proxy providers appear to operate in direct coordination with botmasters. Brundage identified one proxy vendor aggressively marketing affordable, abundant bandwidth to content scraping operations. Upon examining that provider's proxy inventory, Brundage discovered a one-to-one correspondence with IP addresses previously linked to the Aisuru botnet.
By most metrics, the world's largest residential proxy operation is IPidea, a China-headquartered network ranking fifth on Spur's list. Brundage identified IPidea's subsidiary brands as ABCProxy (third), Roxlabs, LunaProxy, PIA S5 Proxy, PyProxy, 922Proxy, 360Proxy, IP2World, and Cherry Proxy. Kilmer noted that Spur also attributes Yilu Proxy (tenth) to IPidea.
All these providers operate under a corporate structure known in cybercriminal forums as HK Network. "The way it works is there's this whole reseller ecosystem, where IPidea will be incredibly aggressive and approach all these proxy providers with the offer, 'Hey, if you guys buy bandwidth from us, we'll give you these amazing reseller prices,'" Brundage explained. "But they're also very aggressive in recruiting resellers for their apps."
These applications include various low-cost and complimentary virtual private networking services that genuinely offer free VPN access while simultaneously converting user devices into traffic relays available for rental to cybercriminals or distribution to other proxy networks. "They have all this bandwidth to offload," Brundage said of IPidea and affiliated networks. "And they can do it through their own platforms, or they go get resellers to do it for them by advertising on sketchy hacker forums to reach more people."
IPidea's flagship brand, 922S5Proxy, deliberately echoes 911S5Proxy, which dominated the market from 2015 through 2022. KrebsOnSecurity published an investigation into 911S5Proxy's origins and apparent Chinese operators in July 2022. Within a week, 911S5Proxy announced closure following a major server breach. That reporting identified Yunhe Wang of Beijing as the apparent proprietor or administrator of 911S5. In May 2024, the U.S. Department of Justice apprehended Wang, alleging his network facilitated theft of billions from financial institutions, credit card issuers, and federal lending initiatives. Concurrently, the U.S. Treasury Department imposed sanctions against Wang and two additional Chinese nationals for operating 911S5Proxy.
DATA SCRAPING FOR AI
In recent months, multiple researchers tracking botnet and proxy operations have documented substantial content scraping benefiting AI companies now utilizing these proxy networks to further obscure their intensive data-collection activities. By routing traffic through residential IP addresses, scraping operations can render their activity substantially harder to filter. "It's really difficult to block, because there's a risk of blocking real people," Kilmer said regarding LLM scraping routed through individual residential addresses, frequently shared by multiple simultaneous customers.
Kilmer contends that the AI sector has lent legitimacy to residential proxy operations, previously dominated by questionable affiliate schemes, automated abuse, and unwanted traffic. "Web crawling and scraping has always been a thing, but AI made it like a commodity, data that had to be collected," Kilmer stated. "Everybody wanted to monetize their own data pots, and how they monetize that is different across the board."
Kilmer noted that numerous LLM-related scrapers depend on residential proxies when content providers have restricted access—through app-only interaction or login pages with multi-factor authentication. "Where the cost of data is out of reach — there is some exclusivity or reason they can't access the data — they'll turn to residential proxies so they look like a real person accessing that data," Kilmer said of such scraping operations.
Increasingly aggressive AI crawlers are overwhelming community-maintained systems, effectively launching sustained DDoS attacks against critical public infrastructure. A LibreNews report from earlier this year found certain open-source initiatives now experiencing as much as 97 percent of traffic from AI company bots, dramatically raising bandwidth expenses, destabilizing services, and straining already under-resourced maintainers.
Cloudflare is piloting capabilities allowing content creators to levy fees on AI crawlers accessing their sites. The company's pay-per-crawl feature, currently in private beta, enables publishers to establish pricing requirements before bots scrape content.
On October 22, Reddit initiated legal action against Oxylabs and multiple other proxy providers, asserting their systems facilitated mass-scraping of Reddit user material despite Reddit's protective measures. "Recognizing that Reddit denies scrapers like them access to its site, Defendants scrape the data from Google's search results instead," the lawsuit alleged. "They do so by masking their identities, hiding their locations, and disguising their web scrapers as regular people (among other techniques) to circumvent or bypass the security restrictions meant to stop them."
Denas Grybauskas, chief governance and strategy officer at Oxylabs, expressed shock and disappointment regarding the lawsuit. "Reddit has made no attempt to speak with us directly or communicate any potential concerns," Grybauskas stated. "Oxylabs has always been and will continue to be a pioneer and an industry leader in public data collection, and it will not hesitate to defend itself against these allegations. Oxylabs' position is that no company should claim ownership of public data that does not belong to them. It is possible that it is just an attempt to sell the same public data at an inflated price."
Despite Aisuru's scale and influence, it represents merely one contributor to the broader residential proxy ecosystem. On June 5, the FBI's Internet Crime Complaint Center warned that BADBOX 2.0, an IoT malware threat, had compromised millions of smart-TV boxes, digital projectors, vehicle infotainment systems, picture frames, and additional IoT equipment. In July, Google filed suit in New York federal court against alleged perpetrators of the Badbox botnet. Google asserted that Badbox 2.0 "compromised more than 10 million uncertified devices running Android's open-source software, which lacks Google's security protections. Cybercriminals infected these devices with pre-installed malware and exploited them to conduct large-scale ad fraud and other digital crimes."
A FAMILIAR DOMAIN NAME
Brundage noted that Aisuru's operators maintain their own SDK, and curiously, portions of its code instruct newly-infected systems to query the domain fuckbriankrebs[.]com. This appears to constitute an elaborate insult directed at this publication's author: one of the botnet's purported associates operates under the moniker Forky and was identified in June by KrebsOnSecurity as a young resident of Sao Paulo, Brazil.
Brundage observed that only systems compromised via Aisuru's Android SDK are compelled to resolve the domain. Early speculation considered whether the domain might function as a botnet kill switch, though Brundage and other interviewed sources deemed this improbable.
If the domain held operational significance for the botnet, they reasoned, why remained it unregistered and openly available for purchase? The domain was subsequently secured by Philippe Caturegli, self-described "chief hacking officer" at security intelligence firm Seralys. Caturegli deployed a passive DNS server on the domain and within hours received more than 700,000 requests for unique subdomains on fuckbriankrebs[.]com.
Even with this visibility into Aisuru, leveraging the domain check-in to gauge true botnet scale proves challenging, Brundage cautioned. The systems querying the domain represent only a fraction of the complete botnet. "The bots are hardcoded to just spam lookups on the subdomains," he noted. "So anytime an infection occurs or it runs in the background, it will do one of those DNS queries."
The domain fuckbriankrebs[.]com carries a storied past. Upon initial registration in 2009, it distributed malware via the Cutwail spam botnet. In 2011, it featured in a notable DDoS campaign targeting this site, powered by Russkill (also known as Dirt Jumper). Domaintools.com records show that in 2015, fuckbriankrebs[.]com was registered to an email address connected to David "Abdilo" Crees, a 27-year-old Australian sentenced in May 2025 to time served for cybercrime convictions related to the Lizard Squad hacking collective.
Source: Krebs on Security