5socks.net
- Category: 💻 Cybercrime
- Seized Date: 2025-05-09
- Visibility: Clear Web
Description
5socks.net was an illegal proxy service that, like Anyproxy.net, sold access to a vast network of compromised residential routers infected with TheMoon malware. It offered thousands of proxy IPs for rent, enabling cybercriminals to mask their activities, such as fraud, credential stuffing, and bot attacks.
Launched in the mid-2000s and active for nearly 20 years, 5socks.net generated tens of millions of dollars by leasing access to infected routers, primarily older Linksys and Cisco devices. Customers paid via cryptocurrency to remain anonymous.
In May 2025, law enforcement agencies including the FBI and Dutch police seized the domain and shut down the operation as part of Operation Moonlander. Four suspects—three Russians and one Kazakhstani—were charged with conspiracy and damage to protected computers, effectively ending the service.
seized message
