911 S5 botnet dismantlement
Verified core entry, last reviewed August 21, 2026
What was taken down?
23 domains and more than 70 servers seized; botnet infrastructure dismantled; approximately 30 million USD in assets seized or restrained.[1][2]
See what happenedWhat happened to the people?
Officials reported 1 charged and 1 apprehended.
1 charged and 1 apprehended named in the public record.
Group accounted for: Likely complete
Did it stay down?
Not established in the public record. No later activity is recorded against this entry.
See what happened afterwardUS-led international operation dismantling the 911 S5 residential proxy botnet, described by the FBI Director as likely the world's largest botnet, with the administrator arrested in Singapore.[1][2]
Announced May 29, 2024.
- Date
- May 24 to May 29, 2024
- Target
- 911 S5, residential proxy botnet
- Activity
- Malware and botnets, Criminal hosting and proxies, Fraud and stolen data
- Operational lead
- FBI
- Partners
- DCIS, SPF, and 1 more[1][2]
- Defense Criminal Investigative Service , investigating
- Singapore Police Force , arresting
- Office of Foreign Assets Control, United States Department of the Treasury , other
- Jurisdiction
- United States, Singapore, Thailand, and Germany
- Outcome
- 23 domains and more than 70 servers seized; botnet infrastructure dismantled; approximately 30 million USD in assets seized or restrained.
- Status
- Completed
- Legal mechanism
- US seizure warrants and criminal charges; Singapore, Thai, and German judicial cooperation
- Group accounted for
- Likely complete
Infrastructure
23 domains seized, 70 servers seized, and 19,000,000 IP addresses disabled.
- 23
- domains seized
- more than 70
- servers seized
- more than 19,000,000
- IP addresses disabled
| Identifier | Recorded as | Status | Notes |
|---|---|---|---|
| Not published | 23 domains | Seized | 23 domains seized as part of the dismantlement.[2] |
| Not published | more than 70 servers | Seized | More than 70 servers seized.[2] |
| Not published | more than 19,000,000 IP addresses | Disabled | More than 19 million unique IP addresses were compromised and used as proxies, including 613,841 in the United States.[2] |
Domains and onion addresses are shown defanged. Where the record gives a count but no identifier, the count is shown in place of one. This list carries only what appears in the cited sources.
- 1
- charged
- 1
- apprehended
Named in the public record: 1 charged and 1 apprehended.
Figures count individuals named in charging documents and official statements, each person once per outcome. People alleged to be involved but not publicly identified are not counted.
| Person | Role | Current public status |
|---|---|---|
| Administrator of the 911 S5 residential proxy botnet | ArrestedSanctionedCharged | |
|
||
YunHe Wang
Administrator of the 911 S5 residential proxy botnet. Current public status: Arrested, Sanctioned, and Charged.
- Charging authority
- United States Department of Justice
- Main charges
- Conspiracy to commit computer fraud; Substantive computer fraud; Conspiracy to commit wire fraud; Conspiracy to commit money laundering
- Case number
- Not established in the public record
- Arresting authority
- Singapore Police Force
- Arrest location
- Singapore
- Extradition status
- Not established in the public record
- Conviction or plea
- Not established in the public record
- Sentence
- Not established in the public record
- Segment
- Core operator
- Full record
- Everything indexed for YunHe Wang
Rows expand to show charging authority, case identifiers, custody status, and sources.
Group accounted for: Likely complete
The principal administrator was arrested and the infrastructure dismantled. Associates were designated under sanctions rather than criminally charged, so the criminal roster is not formally closed.
One principal administrator charged; several associates named in the parallel sanctions action rather than in criminal charges.
YunHe Wang arrested and prosecuted; OFAC sanctioned Wang, associates, and three Thai entities separately.[1][2]
Not established in the public record. No later activity is recorded against this entry.
Return class G. The class is a research grading carried in the source dataset and its scale is not published, so this page relies on the relationship and confidence values instead. How this index handles it.
Numbered markers throughout this entry link to the source that supports the claim beside them.
Official sources
-
[1]
Treasury Sanctions Actors Behind the 911 S5 Botnet
Sanctions designations of Wang, associates, and three Thai entities
-
[2]
911 S5 Botnet Dismantled and Its Administrator Arrested in Coordinated International Operation
Arrest of YunHe Wang, domain and server seizures, 19 million compromised IP addresses including 613,841 in the United States
- Official figure: more than 19 million unique IP addresses compromised, including 613,841 in the United States.
- Linked to approximately 5.9 billion USD in pandemic-relief fraud losses, a victim-side figure.
- Sanctions designations are recorded separately and are not counted as criminal charges.