Dutch Police Take Down Malicious Proxy Network Exploiting 178,000 Devices

Proxy Network Dismantled

The Dutch National Police, the Netherlands Public Prosecutor's Office, and the Shadowserver Foundation have taken down a malicious proxy service consisting of 178,000 compromised devices. Through the service, criminals were able to exploit the IP addresses of innocent citizens and businesses.

Users of the service could connect to the internet via these devices without the owners' knowledge. If criminals used the service to commit cybercrimes, the IP addresses of innocent citizens and businesses could be wrongly flagged as suspicious in criminal investigations, the police stated in a press release. A proxy server acts as an intermediary between a user and the internet, forwarding requests to hide a client's public IP address and conceal their online identity and location, which makes such services attractive to cybercriminals.

Servers Seized at Multiple Hosting Providers

Police officers took down servers at multiple hosting providers last week, with more server takedowns expected in the near future. Anyone trying to visit the proxy service's website will now see a splash page stating that "this website has been taken down" by the Dutch National Police, the Netherlands Public Prosecutor's Office, and the Shadowserver Foundation.

How the devices got infected has not been disclosed.

International Cooperation Against Cybercrime

The Shadowserver Foundation is a nonprofit security organization that helps make the internet more secure. The Dutch National Police said cybercrime is not combated solely through investigation and prosecution. By gathering and analyzing data and through national and international cooperation, the police disrupt the operations of cybercriminals to prevent victims.

Earlier this year, the Dutch National Police, together with the FBI, took the proxy service SocksEscort offline. That service quietly hijacked 369,000 WiFi routers and other devices and helped hackers hide their internet traffic behind residential IP addresses.

Sources: Cybernews