Home · Briefs · CTI Weekly Summary — 2026-W22 (May 25 – May 31, 2026)
Asocks residential-proxy botnet — Dutch Police + NCSC dismantle ~17M-device infrastructure hosted in the Netherlands
From CTI Weekly Summary — 2026-W22 (May 25 – May 31, 2026) · published 2026-05-25
The Cybercrime Team of the Police Unit The Hague, with the Dutch NCSC, dismantled a large residential-proxy botnet — at least 17 million compromised consumer devices worldwide, run through ~200 servers all physically hosted in the Netherlands (2026-05-29); NL Times and other reporting identify the service as Asocks (the politie.nl primary states the scale and the NL-hosted infrastructure but does not name it). The operationally relevant point is what was hit: residential-proxy services are the anonymisation plumbing that launders credential-stuffing, scraping and fraud traffic to look like ordinary consumer ISP connections, defeating IP-reputation controls. The takedown degrades that capability industry-wide for a period, but — consistent with the W21 takedown pattern — expect infrastructure churn rather than a durable drop; the demand for residential-proxy egress is undiminished.