Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
The United States took two linked actions against the 911 S5 cybercrime operation in May 2024: the Treasury Department’s Office of Foreign Assets Control (OFAC) sanctioned three Chinese nationals and three Thailand-based companies on May 28, and the Justice Department announced Yunhe Wang’s arrest and an international infrastructure-seizure operation on May 29.
911 S5 was not simply a conventional VPN. According to Treasury and DOJ, it was a malware-powered residential-proxy network that allegedly used compromised Windows computers to route customers’ traffic through innocent people’s residential internet connections.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Network Security, Firewalls, and VPNs | $66.62 | Buy on Amazon |
| 2 |
|
Network Security, Firewalls, and VPNs: . (Issa) | $60.87 | Buy on Amazon |
| 3 |
|
TP-Link ER605, Wired Gigabit VPN Router | $49.99 | Buy on Amazon |
| 4 |
|
Cybersecurity for Small Networks: A Guide for the Reasonably Paranoid | $32.51 | Buy on Amazon |
What 911 S5 was
A botnet is a network of compromised computers controlled or used by an operator. A residential proxy service sells the ability to make internet traffic appear to originate from residential IP addresses. 911 S5 allegedly combined both models:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11- People were encouraged to install free VPN software, including programs identified by the government as MaskVPN and DewVPN.
- The software allegedly installed or enabled malware on Windows computers and turned them into traffic relays.
- 911 S5 aggregated the computers’ residential IP addresses into a proxy pool.
- Paying customers could route traffic through selected compromised devices, making activity appear to come from victims’ homes or businesses.
That distinction matters. The VPN branding was reportedly the lure; the alleged business was the unauthorized use and sale of access to compromised residential connections. This does not mean every free VPN is malicious, or that every user of MaskVPN or DewVPN was necessarily compromised.
#1 Best Overall
The alleged flow was:
Free VPN installation → compromised computer becomes a relay → residential IP enters the proxy pool → customer routes traffic through the victim’s connection.
Who Treasury sanctioned
| Person or entity | Alleged role or basis for designation |
|---|---|
| Yunhe Wang | Treasury identified Wang as the primary administrator of 911 S5. DOJ charged him with creating and operating the botnet and deploying malware. |
| Jingping Liu | Treasury identified Liu as an alleged co-conspirator involved in laundering proceeds. The alleged process included converting cryptocurrency payments through over-the-counter vendors and moving funds into accounts held by Liu. |
| Yanni Zheng | Treasury said Zheng acted as Wang’s power of attorney and conducted payments, business transactions, and real-estate purchases on Wang’s behalf. |
| Spicy Code Company Limited | Thailand-based company Treasury said was owned or controlled by Wang. |
| Tulip Biz Pattaya Group Company Limited | Thailand-based company Treasury said was owned or controlled by Wang. |
| Lily Suites Company Limited | Thailand-based company Treasury said was owned or controlled by Wang. |
Treasury’s announcement did not describe Liu and Zheng as technical administrators in the same way it described Wang. Their alleged roles were principally financial, transactional, or representative.
What the OFAC sanctions mean
OFAC designations are financial and regulatory measures, not criminal convictions. In general, property and property interests of the designated people and companies that are in the United States, or in the possession or control of U.S. persons, must be blocked and reported to OFAC. U.S. persons are generally prohibited from dealing in that blocked property or conducting transactions involving the designated parties, including transactions that pass through the United States.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesSanctions can restrict access to U.S. banks, payment channels, and assets while making it harder for designated parties to move or use money internationally. They operate alongside, rather than replace, the criminal case against Wang.
Wang’s arrest and the infrastructure takedown
DOJ said Wang was arrested on May 24, 2024. The indictment alleged that he received approximately $99 million from selling access to hijacked IP addresses between 2018 and July 2022. Wang was charged in connection with creating and operating 911 S5 and deploying malware.
DOJ also said the coordinated operation:
- Seized 23 domains and more than 70 servers.
- Seized approximately $30 million in assets and identified another approximately $30 million in forfeitable property.
- Targeted both the historical 911 S5 infrastructure and an attempted successor service called CloudRouter.io.
- Involved authorities and assistance from the United States, Singapore, Thailand, and Germany, as well as the FBI, OFAC, Defense Criminal Investigative Service, Commerce Department’s Office of Export Enforcement, DOJ’s Criminal Division, Chainalysis, Shadowserver Foundation, and Microsoft.
The action was therefore more than a financial designation or a routine domain seizure. It combined an arrest, asset tracing, server and domain seizures, and an attempt to prevent the service from being rebuilt under a new name.
Rank #2
- Available with the Cloud Labs which provide a hands-on, immersive mock IT infrastructure enabling students to test their skills with realistic security scenarios
- New Chapter on detailing network topologies
- The Table of Contents has been fully restructured to offer a more logical sequencing of subject matter
- Introduces the basics of network security—exploring the details of firewall security and how VPNs operate
- Increased coverage on device implantation and configuration
How large was 911 S5?
DOJ said compromised computers were located in nearly 200 countries and were associated with more than 19 million unique IP addresses, including 613,841 U.S. IP addresses.
“19 million unique IP addresses” should not be read as proof that 19 million computers were continuously infected at the same time. IP addresses can change, and the government’s wording describes addresses associated with the compromised infrastructure rather than a precise count of simultaneously active machines.
DOJ said Wang operated approximately 150 dedicated servers worldwide, about 76 of them leased from U.S.-based providers.
How the network allegedly enabled fraud
Residential IP addresses can look more like ordinary household or business connections than data-center traffic. That may help a criminal customer evade geographic restrictions, reputation checks, or fraud-detection systems. The proxy network allegedly gave customers a way to hide the true origin of their activity behind someone else’s connection.
DOJ estimated that approximately 560,000 fraudulent unemployment-insurance claims originated from compromised IP addresses and that confirmed fraudulent unemployment-insurance losses exceeded $5.9 billion. It also said more than 47,000 Economic Injury Disaster Loan applications originated from compromised IP addresses.
Those figures require careful interpretation. An application originating from a compromised IP address is evidence about the apparent network origin, not proof that the 911 S5 operators personally submitted every application or that every dollar associated with those addresses was caused by the botnet. Treasury used the broader formulation that the botnet contributed to the loss of billions of dollars to the U.S. government, including through fraudulent CARES Act-related applications. The $5.9 billion figure is the more specific DOJ estimate for confirmed fraudulent unemployment-insurance losses.
Rank #3
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
DOJ said customers also used the service in alleged financial fraud, identity theft, credit-card fraud, cyberstalking, harassment, bomb threats, threats of harm, child-exploitation offenses, illegal exportation of goods, and efforts to circumvent fraud-detection systems. Treasury said 911 S5-associated IP addresses were linked to bomb threats made across the United States in July 2022.
The alleged money trail
According to Treasury, customers primarily paid in cryptocurrency. The alleged proceeds were converted into U.S. dollars through over-the-counter vendors and transferred through accounts associated with Liu. Treasury also alleged that accounts in Liu’s name were used to acquire luxury real estate for Wang.
The sanctions and forfeiture actions targeted the financial infrastructure supporting the alleged operation, while the criminal case addressed Wang’s alleged conduct. DOJ stated that an indictment is an allegation and that Wang is presumed innocent unless proven guilty beyond a reasonable doubt.
Timeline
- 2014–2015: Government and investigative accounts place the alleged beginning of the operation in this period.
- 2015–July 2022: Investigative reporting described the sale of access to compromised Windows computers.
- July 2022: KrebsOnSecurity reported on the service’s shutdown after a breach and identified Wang as its apparent owner or manager. Treasury also said associated IP addresses were linked to U.S. bomb threats that month.
- Late 2022: Public reporting described a reappearance under the Cloud Router or CloudRouter name.
- May 24, 2024: DOJ said Wang was arrested.
- May 28, 2024: OFAC sanctioned the three individuals and three Thailand-based companies.
- May 29, 2024: DOJ publicly announced the dismantling and arrest.
For investigative background on the service’s earlier shutdown and distribution model, see KrebsOnSecurity’s reporting and its 2022 investigation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Could an ordinary person’s IP address have been involved?
Yes, according to the alleged delivery model. A person could have installed software believing it was a legitimate free VPN while the computer was used as a relay for someone else’s traffic. Their IP address could then appear in records associated with fraud or other abuse even though the resident did not conduct that activity.
Possible warning signs include an unfamiliar VPN application, unexpected VPN adapters or network services, unexplained upload traffic, unusual CPU, memory, or bandwidth use, security alerts involving suspicious installers, or sudden IP-reputation problems and account-security challenges. None of these symptoms proves 911 S5 infection; many unrelated software, network, or account problems can produce similar signs.
What suspected victims should do
- Check installed applications, browser extensions, VPN profiles, and network adapters for software you do not recognize.
- Run a scan with reputable, updated security software and install pending operating-system updates.
- Remove suspicious software only after saving relevant evidence, such as installer names, alerts, dates, and account notifications.
- Change important passwords from a device you trust, enable multifactor authentication, and contact financial institutions if accounts show unauthorized activity.
- Use the FBI’s 911 S5 resource page for official victim-identification and remediation information.
A clean scan today cannot prove that a computer was never infected, and the takedown of servers does not automatically clean every endpoint that may previously have been compromised.
What the operation accomplished—and what it did not prove
The seizure of domains, servers, and assets disrupted the known 911 S5 infrastructure and the alleged CloudRouter.io successor. International cooperation was important because the operators, servers, victims, customers, payment flows, and affected IP addresses crossed multiple jurisdictions.
But “dismantled” does not mean every historical infection was remediated or that no copycat residential-proxy network could emerge. The eventual criminal-court outcome, the exact number of compromised devices rather than unique IP addresses, and the extent to which individual customer activity can be attributed to particular people are separate questions.
The broader lesson is practical: an IP address identifies the apparent network origin of activity, not necessarily the person behind it. Residential IP reputation can be weaponized against innocent households, and software advertised as a free VPN can conceal a very different business model when its distribution, permissions, ownership, or behavior is opaque.
For the official designations, see Treasury’s OFAC announcement. For the arrest, charges, seizures, and government estimates, see DOJ’s announcement.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
