U.S. authorities say YunHe Wang administered 911 S5, a botnet-backed residential proxy service that routed customers’ internet traffic through malware-compromised Windows computers. The indictment alleges Wang and others built and spread the malware; it does not establish that Wang acted alone or prove the charges. The case also involves several different financial figures that are easy to confuse: alleged service proceeds, confirmed unemployment-insurance fraud losses, suspected loan fraud, and assets seized or identified for forfeiture.
What was the 911 S5 botnet?
Authorities described 911 S5 as a residential proxy service built on compromised computers—not a legitimate VPN product. According to the U.S. Department of Justice (DOJ), malware infected residential Windows computers and made their IP addresses available to customers for a fee. That let customers route traffic through those devices so it appeared to come from residential internet connections. The DOJ says customers used the service in financial crimes, stalking, threats, illegal exports, and crimes involving child sexual abuse material. These are allegations described in the indictment and DOJ announcement, not findings that every customer or device was involved in each type of crime. DOJ announcement
The FBI identifies six free, illegitimate VPN apps created to connect to 911 S5: MaskVPN, DewVPN, PaladinVPN, ProxyGate, ShieldVPN, and ShineVPN. Their presence on a computer is a reason to follow the FBI’s official identification and removal guidance—not evidence that the device owner committed a crime. FBI identification and removal guidance
Was one person behind the whole operation?
The title’s “single person” framing needs a qualification. Wang, a Chinese national and citizen of St. Kitts and Nevis by investment, was arrested on May 24, 2024. An indictment unsealed that day alleges that Wang and others created and disseminated the malware from 2014 through July 2022, and describes Wang as the service’s administrator. It does not say he was the only person involved. An indictment is an accusation, not proof of guilt; DOJ says defendants are presumed innocent unless proven guilty beyond a reasonable doubt. DOJ announcement and case allegations
#1 Best Overall
- NIGHTHAWK WIFI 6 ROUTER FOR YOUR WHOLE HOME: Delivers fast, reliable WiFi across every room of your apartment or small home for streaming, gaming, video calls, and smart home devices, all running at the same time without slowing each other down.
- WORKS WITH YOUR EXISTING INTERNET SERVICE: Pairs with your existing modem or gateway via ethernet. Compatible with most cable, fiber, DSL, and satellite providers. Some gateways and modem router combos may require bridge mode. No coax needed.
- SET UP AND MANAGE YOUR NETWORK WITH THE NIGHTHAWK APP: Download the free Nighthawk app on iOS or Android for guided setup. Manage WiFi, run speed tests, pause devices, and set up guest networks from anywhere. Active internet required.
- READY FOR THE DEVICES YOU ALREADY OWN: Your phones, laptops, and TVs work right out of the box. WiFi 6 delivers speeds up to 1.8 Gbps across 2.4 GHz and 5 GHz bands. Backward compatible with WiFi 5 and earlier.
- COVERAGE IN EVERY ROOM: Covers up to 1,500 sq. ft. for up to 20 connected devices. Walls, floors, and interference can reduce range. Larger or multi-story homes may benefit from a NETGEAR Orbi mesh WiFi system.
What do the scale and financial figures mean?
The numbers refer to different things and should not be treated as interchangeable. DOJ reported more than 19 million unique IP addresses associated with compromised devices, including 613,841 U.S. IP addresses. The FBI describes more than 19 million compromised IP addresses across more than 190 countries. An IP-address count is not a demonstrated count of individual people: addresses may not map one-to-one to users or devices. DOJ figures · FBI figures
- $99 million: DOJ’s estimate of alleged proceeds from sales of hijacked proxied IP addresses from 2018 through July 2022. This is not a loss figure for victims. DOJ announcement
- More than $5.9 billion: Government-reported confirmed losses from fraudulent unemployment-insurance claims that originated from compromised IP addresses. DOJ says those claims numbered 560,000. The figure is not Wang’s alleged proceeds, and the IP connection alone does not establish that he personally caused each claim. DOJ announcement
- More than 47,000 applications: Economic Injury Disaster Loan applications originating from compromised IP addresses that appeared in the government’s suspected-fraud review. DOJ describes these as applications evaluated for suspected fraud, not confirmed loss claims. DOJ announcement
- About $30 million seized; about $30 million more identified: DOJ reported approximately $30 million in assets seized and a separate approximately $30 million in additional forfeitable property identified during the operation. Seized property and property identified for forfeiture are distinct categories. DOJ announcement
FBI Director Christopher Wray called 911 S5 “likely the world’s largest botnet ever” in the DOJ’s May 29, 2024 announcement. That is his characterization, not a measured universal ranking. DOJ announcement, May 29, 2024
Rank #2
- Dual-band Wi-Fi with 5 GHz speeds up to 867 Mbps and 2.4 GHz speeds up to 300 Mbps, delivering 1200 Mbps of total bandwidth¹. Dual-band routers do not support 6 GHz. Performance varies by conditions, distance to devices, and obstacles such as walls.
- Covers up to 1,000 sq. ft. with four external antennas for stable wireless connections and optimal coverage.
- Supports IGMP Proxy/Snooping, Bridge and Tag VLAN to optimize IPTV streaming
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
- Advanced Security with WPA3 - The latest Wi-Fi security protocol, WPA3, brings new capabilities to improve cybersecurity in personal networks
What happened to 911 S5 and Cloudrouter?
The FBI says the 911 S5 administrator took the service offline in July 2022 and reconstituted it as Cloudrouter in October 2023. In May 2024, a coordinated international operation seized 23 domains and more than 70 servers, including infrastructure associated with an effort to reconstitute the service. DOJ also says authorities closed existing malicious backdoors. FBI account · DOJ announcement
These sources describe the arrest, indictment, and disruption, but do not establish a later final court disposition. The charges therefore remain allegations unless and until resolved in court.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
- Wi-Fi 6 Mesh Wi-Fi - Next-gen Wi-Fi 6 AX3000 whole home mesh system to eliminate weak Wi-Fi for good(2×2/HE160 2402 Mbps plus 2×2 574 Mbps)
- Whole Home WiFi Coverage - Covers up to 6500 square feet with seamless high-performance Wi-Fi 6 and eliminate dead zones and buffering. Better than traditional WiFi booster and Range Extenders
- Connect More Devices - Deco X55(3-pack) is strong enough to connect up to 150 devices with strong and reliable Wi-Fi
- Our Cybersecurity Commitment - TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement
- More Gigabit Ports - Each Deco X55 has 3 Gigabit Ethernet ports(6 in total for a 2-pack) and supports Wired Ethernet Backhaul for better speeds. Any of them can work as a Wi-Fi Router
What should you do if one of the apps is on your computer?
If you find MaskVPN, DewVPN, PaladinVPN, ProxyGate, ShieldVPN, or ShineVPN, use the FBI’s official identification and removal guidance. Do not infer that a particular person committed a crime merely because an IP address associated with the botnet appears in an investigation. An IP address is not, by itself, proof of who used a connection or what they did.
Quick Recap
Rank #4
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
