We Tested Smartproxy.org’s IP Pool: Here’s What We Found
In late January 2026, Google disrupted IPIDEA – one of the largest residential proxy networks in the world, linked to botnets, cybercrime, and deceptive device recruitment. Weeks later, we tested a provider, also known as the original Smartproxy (now Decodo) impersonator, Smartproxy.org. We purchased a weekly plan, ran roughly seven million requests, and compared the exit IPs against a verified IPIDEA database.
Key Findings
- The test surfaced 2,023,029 unique IP addresses (2,019,488 IPv4 and 3,541 IPv6).
- We compared these IPs against a verified IPIDEA dataset of 16,192,293 unique IPs covering January 2026.
- 773,087 IPs (38.21%) from Smartproxy.org’s pool were also present in the IPIDEA dataset.
- The overlap strongly suggests that Smartproxy.org either resells IPIDEA’s infrastructure directly or uses it as a significant IP source.
Background: What Happened to IPIDEA
On January 28, 2026, Google announced coordinated action against IPIDEA, a Chinese company operating one of the world’s largest residential proxy networks. According to The Wall Street Journal, the measures were expected to knock over nine million devices off the network.
IPIDEA controls or is related to more than a dozen Hong Kong-incorporated brands selling proxy servers, including 360Proxy, 922Proxy, ABC Proxy, Cherry Proxy, IP2World, LunaProxy, PIA S5 Proxy, PyProxy, and TabProxy.
Google Threat Intelligence Group’s action had three main components:
- Domain takedowns. Legal action to seize both the public-facing domains of IPIDEA’s brands and the command-and-control domains used to manage the proxy network.
- Intelligence sharing. Technical intelligence on IPIDEA’s SDKs and proxy software was shared with platform providers, law enforcement, and research firms. SDKs are components installed into apps like free VPNs to silently recruit devices into the proxy network.
- Google Play enforcement. Google Play Protect now automatically warns users and removes applications known to incorporate IPIDEA SDKs, while also blocking future install attempts.
Why It Matters?
Google’s research found that IPIDEA’s network had facilitated several large botnets, including BADBOX2.0, Kimwolf, and Aisuru. Over 550 threat groups used IPIDEA’s proxies to mask malicious activity. External research by Synthient surfaced vulnerabilities in IPIDEA’s infrastructure that allowed botnet operators to access and recruit other devices on local networks.
This wasn’t a minor compliance issue. IPIDEA had become a significant vector for cybercrime, and its reach extended well beyond the brands that shared its name.
IPIDEA’s Impact
Between 2022 and 2024, IPIDEA-related brands had a profound effect on the proxy market. Over 20 new entrants, most incorporated in Hong Kong, flooded the space with cheap residential proxies. They undercut established competitors and, more importantly, popularized unlimited plans that offered unmetered bandwidth and requests for a fixed fee. This was a departure from the industry standard of per-gigabyte or per-request pricing.
In the WSJ article, IPIDEA’s spokeswoman acknowledged that the company and its partners had engaged in aggressive market expansion and promotional activities in inappropriate venues, including hacker forums. While we’ve since seen measures to appear legitimate, like professing ethical IP sourcing and customer screening (KYC), we found them to lack grounding and actual enforcement.
Why We Investigated Smartproxy.org?
We’d had suspicions about Smartproxy.org’s ties to IPIDEA for a while. The provider shares several characteristics with the cluster of IPIDEA-affiliated brands mentioned earlier.
Unlimited Pricing
IPIDEA-related brands made the unlimited residential proxy model their signature. Smartproxy.org offers the same structure – unmetered bandwidth and requests for a fixed hourly, daily, or monthly fee.
The economics of offering genuinely sourced residential proxies at these price points have always been questionable. Running a large-scale residential proxy network requires paying for bandwidth, maintaining infrastructure, and compensating the owners of the devices that serve as exit nodes.
Unlimited plans at low price points only make sense if the cost of IP sourcing is close to zero, which, in IPIDEA’s case, it effectively was, since devices were recruited through SDKs embedded in apps without proper disclosure.
Limited Transparency
Many IPIDEA-related brands shared a pattern of providing little verifiable information about their corporate structure, IP sourcing methods, or compliance practices. Smartproxy.org fits this description. The website offers minimal detail about the company behind the service, and there is no publicly available information about how its residential IPs are sourced or what consent mechanisms are in place.
Market Position
Like other IPIDEA-adjacent providers, Smartproxy.org positions itself as a budget alternative to established proxy services while claiming large residential IP pools. This mirrors the playbook that IPIDEA-linked brands used to gain market share between 2022 and 2024.
How We Tested It?
The methodology was deliberately simple. We wanted something anyone with a subscription could replicate using basic tooling.
Step #1: Purchase a Plan
We bought a weekly unlimited residential proxy plan from Smartproxy.org. No special configuration, no enterprise-tier access, just a standard subscription available to any customer.
Step #2: Generate Traffic
Over the course of one week in February 2026, we routed approximately 7 million requests through Smartproxy.org’s proxy infrastructure. Each request was directed to an IP-checking endpoint, which recorded the exit IP address. In principle, any IP checker would work for this purpose. You’re simply logging which IP address each request originates from.
Step #3: Collect and Deduplicate IPs
Out of nearly 7 million total requests, the test returned 2,023,029 unique IP addresses. Here’s the breakdown:
The pool was overwhelmingly IPv4. The 90.25% success rate means roughly one in ten requests failed or timed out, a separate performance conversation, but for this analysis, the pool composition mattered more than speed or reliability.
Step #4: Compare against the IPIDEA Reference Dataset
For the comparison, we used a publicly available IPIDEA IP dataset published by Antoine Vastel, a cybersecurity researcher who runs the proxy detection database. On January 29, 2026, the day after Google’s announcement, Vastel released two downloadable CSVs containing verified exit IPs whose last observed provider was part of the IPIDEA network.
The dataset covered a 30-day window ending January 29, 2026, and contained 16,192,293 unique IP addresses. Critically, every IP in the dataset was verified, meaning Vastel actually routed traffic through it and confirmed it worked as an active proxy endpoint. This is not a speculative or self-reported list; it’s operational data.
The IPs were broken down by the last observed provider as follows:
All three providers, PyProxy, PIA S5 Proxy, and Luna Proxy, are brands Google explicitly tied to the IPIDEA network.
Time Gap Between Tests
Our test ran in early February 2026, a few weeks after Vastel’s dataset coverage ended on January 29. This gap matters in both directions. Some IPs active on IPIDEA’s network in January may have rotated out of Smartproxy.org’s pool by the time we tested. Conversely, new IPs may have entered both pools in the interim. If anything, the gap likely understates the true overlap, since residential IP churn means fewer matches over time, not more.
Results
The comparison between Smartproxy.org’s IP pool and Vastel’s IPIDEA dataset produced the following:
In plain terms, more than one in three IP addresses we encountered through Smartproxy.org also appeared in the IPIDEA dataset.
The 4.77% figure from the other direction is less dramatic, but that’s expected. IPIDEA’s dataset is roughly eight times larger and covers a longer observation period (30 days vs. our one week). A smaller pool will always represent a modest fraction of a much bigger one, even if the smaller pool draws heavily from it.
Interpreting the Overlap
A 38% overlap between two residential proxy pools is substantial, but IP overlap data requires careful interpretation. Residential IPs are dynamic – they rotate between users, get reassigned by ISPs, and can appear across multiple proxy networks over time. Some degree of overlap between any two large residential pools is natural. The question is how much is too much to be coincidental.
What the data does establish is that IPIDEA is very likely either a direct upstream supplier or a significant source within Smartproxy.org’s proxy network. The overlap is too large and the timing too tight for the explanation to be a coincidence.
IP Retention as a Baseline
To understand the significance of 38%, it helps to understand how quickly residential IP pools change. According to IPinfo, monthly IPv4 retention in residential proxy pools sits at around 40%. That means roughly 40% of the IPs you see in a given pool this month will still be there next month, while the rest rotate out and get replaced. Residential pools are fluid but not entirely unpredictable. They maintain a recognizable core of addresses over short time windows.
If two pools were completely independent, sourcing IPs from different SDKs, different apps, different device populations across different geographies, you’d expect the overlap to reflect the general background rate of IP reuse across the internet.
For large pools of this size, that background rate would be significantly lower than 38%. The internet has over 4 billion routable IPv4 addresses – even accounting for the fact that residential proxy IPs cluster in certain ASNs and regions, a coincidental overlap of 38% between two genuinely independent pools would be extremely unlikely.
Why the Timing Matters
Our test ran only a few weeks after the IPIDEA database’s coverage window closed. Given the natural churn in residential pools, that’s a short interval. If we had tested six months later, a high overlap could more plausibly be attributed to ordinary IP recycling across the internet – the same addresses eventually showing up on different networks simply because ISPs reassign them. At a few weeks’ distance, the connection is much harder to explain away. The IPs were active on IPIDEA’s network in January and active on Smartproxy.org’s network in early February.
What the Pool Size Ratio Tells Us
Smartproxy.org’s pool (two million unique IPs over one week) is a fraction of IPIDEA’s (sixteen million over one month). If Smartproxy.org were one of many customers reselling IPIDEA’s infrastructure or sourcing a portion of its IPs from the same upstream network, this is roughly the ratio you’d expect. A downstream reseller wouldn’t need access to the entire IPIDEA pool – it would draw from a subset.
The 38% overlap from Smartproxy.org’s perspective, combined with the 4.77% from IPIDEA’s, fits the pattern of a smaller provider accessing a portion of a large wholesale network. From IPIDEA’s side, Smartproxy.org would be one customer among many; from Smartproxy.org’s side, IPIDEA would be a major (possibly the primary) source.
The Broader Pattern: IP Fingerprinting as a Detection Method
Smartproxy.org is unlikely to be the only provider sourcing from IPIDEA’s infrastructure. Google’s action disrupted the most visible IPIDEA brands – LunaProxy, ABCProxy, and others had their websites taken down, and their proxy networks were degraded. But the underlying infrastructure doesn’t necessarily disappear when a domain goes offline.
Proxy networks are built on IP sourcing arrangements, SDKs embedded in applications, and device-level software. Changing a brand name or registering a new domain does nothing to alter the underlying pool of devices that serve as exit nodes. The apps that recruited those devices are still installed, the SDKs are still running, and the IPs continue to route traffic.
This is exactly what makes IP overlap analysis useful as a detection method. Brand names can be changed, corporate structures reshuffled, and websites relaunched overnight. But the actual IPs that exist from a network function as a fingerprint. If two providers consistently share a large portion of their exit addresses within a narrow time window, the simplest explanation is shared infrastructure – regardless of what the marketing materials say.
The approach has limitations. Some natural overlap between large residential pools is expected, and the method doesn’t reveal the nature of the commercial relationship (reselling, sub-licensing, or direct infrastructure control). But for a first-pass investigation into whether a provider draws from a known network, IP comparison is fast, replicable, and hard to fake.
What This Means for Smartproxy.org Users?
If Smartproxy.org sources a significant share of its IPs from IPIDEA-related infrastructure, it raises several practical concerns for its users.
Association with Compromised Infrastructure
IPIDEA’s network wasn’t just large – it was actively implicated in botnet operations and cybercrime. Traffic routed through these IPs could be sharing exit nodes with malicious actors, which increases the risk of IP reputation issues, blacklisting, and guilt by association. For use cases like ad verification, SEO monitoring, or market research, a poor IP reputation directly degrades results. Anti-bot systems maintained by major websites track and score IP addresses – if a proxy IP is flagged for malicious activity in one context, requests from the same IP in a different context are more likely to be challenged or blocked.
The Device Sourcing Question
A core part of Google’s case against IPIDEA was how it recruited devices into its network. SDKs embedded in free VPNs and utility apps turned phones and computers into proxy exit nodes – often without meaningful consent from their owners. Google explicitly noted that many of the apps involved did not clearly disclose that installing them would enroll the user’s device in a proxy network.
If Smartproxy.org’s IPs come from the same device pool, the same ethical concerns around consent and transparency apply to its users. In practical terms, you may be routing your traffic through devices whose owners never agreed to serve as proxies.
Service Durability
Google’s disruption of IPIDEA is ongoing, not a one-time event. The domain takedowns, intelligence sharing, and Play Store enforcement are designed to degrade the network over time progressively. If Smartproxy.org depends on IPIDEA’s infrastructure upstream, further enforcement actions could shrink its IP pool without warning. Users relying on the network for business-critical scraping or data collection tasks would face an operational risk that they might not anticipate.
Name Confusion with Decodo (formerly Smartproxy)
Smartproxy.org has no relation to Smartproxy, the well-known Lithuanian proxy provider that rebranded to Decodo in 2025. Despite the nearly identical name, these are two completely separate companies.
Decodo (formerly Smartproxy) operates out of Vilnius, has been in the market since 2018, and is one of the most established residential proxy providers in the industry. Smartproxy.org is a much more obscure operation. The name similarity can and likely does cause confusion among buyers, which raises its own set of questions about the provider’s intent. But for this investigation, we’re focused solely on Smartproxy.org’s IP pool and its relationship to IPIDEA. Decodo has also shared their experience fighting lookalike brands, including Smartproxy.org, and advocated for ethicality and transparency in the industry.
Google’s disruption of IPIDEA in January gave us a concrete reason to test these suspicions. If Smartproxy.org were drawing from the same IP pool, the overlap should be visible in the data.
Bottom Line
We set out to test a long-standing suspicion about Smartproxy.org’s IP sourcing, and the data support it. 38% of Smartproxy.org’s residential IPs overlap with a verified IPIDEA dataset – well above what independent networks would share, and measured within a narrow time window that makes coincidental IP recycling an unlikely explanation.
The most straightforward interpretation – Smartproxy.org either resells IPIDEA’s infrastructure directly or sources a substantial portion of its IPs from the same network Google took action against in January 2026.
Smartproxy.org continues to operate at the time of writing. We’ll monitor the situation and update this report as new information becomes available.
Proxy geek and developer.