Skip to main content
Back to the takedown index

RSOCKS proxy botnet disruption

June 2022, Criminal hosting and proxies
Led by Federal Bureau of Investigation

Extended pass entry, last reviewed August 21, 2026

What was taken down?

Backend infrastructure mapped via undercover technical purchases; disruption of the proxy-selling service followed.

See what happened

What happened to the people?

No individual outcomes are recorded against this entry.
Group accounted for: Not established

See people and accountability

Did it stay down?

Not established in the public record. No later activity is recorded against this entry.

See what happened afterward

FBI, working with USAO Southern District of California and DOJ CCIPS, disrupted a malicious residential-proxy botnet operators claimed encompassed millions of hacked devices, after undercover purchases mapped its backend infrastructure.

Date
June 1 to June 16, 2022
Target
RSOCKS, residential proxy botnet
Activity
Criminal hosting and proxies
Operational lead
FBI
Partners
USAO-SDCA[1]
Jurisdiction
Not established
Outcome
Backend infrastructure mapped via undercover technical purchases; disruption of the proxy-selling service followed.
Status
Completed
Legal mechanism
Federal search-warrant process (S.D. Cal.), publicly unsealed.
Group accounted for
Not established

No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved.

Group accounted for: Not established

The cited record does not say how large the group was or whether everyone involved has been identified.

See the organizations and roles behind this action

Not established in the public record. No later activity is recorded against this entry.

Numbered markers throughout this entry link to the source that supports the claim beside them.

Official sources

  1. [1]
    RSOCKS residential proxy botnet dismantled

    US DOJ / USAO SDCA, June 16, 2022, Source grade P1

    Establishes the FBI's undercover mapping and disruption of RSOCKS proxy infrastructure.

    No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

Coverage note. Added from deep-research aggregation pass. Not independently re-verified source-by-source to the same standard as the original 38-incident core; source_quality capped at S2/P2 pending a dedicated verification pass.