Amsterdam police and FBI dismantle proxy service Anyproxy
In a major international investigation, the Amsterdam police, led by the Public Prosecutor's Office, and the U.S. FBI have taken down the criminal proxy service Anyproxy. The service had been used since 2004 by cybercriminals to commit crimes anonymously, including phishing, ransomware attacks and data theft.
Police.co.uk 12 May 2025
Through Anyproxy, networks worldwide were taken down, large sums of money captured and sensitive data stolen - while the perpetrators stayed out of sight. The prolonged operation of the service and the millions of dollars in damage it caused underscore its importance in preventing large-scale cyber attacks.
What is a proxy service?
A proxy service acts as a way station on the Internet and hides the user's real IP address. This makes the Internet traffic appear to come from a different device, such as a Dutch household's router. Cybercriminals abuse these types of routers, often outdated devices without security updates (so-called "end-of-life" devices), and then offer them for rent through underground marketplaces - exclusively for anonymous payment in crypto currency. This makes tracking down perpetrators difficult.
While proxy services are not illegal per se - many companies use them for privacy protection or access to blocked content - they are also abused by criminals to cover their tracks.
International research
The investigation began after the Amsterdam police discovered that a Dutch citizen's IP address was being misused for digital scams. This led to the discovery that cybercriminals were using Anyproxy to access outdated routers of legitimate Internet connections, which helped them remain undetected.
Anyproxy was responsible for more than 6,000 abused IP addresses, many of them in the United States, according to police investigations. In response, the police decided to cooperate with the FBI under the name "Operation Moonlander.
Dismantling criminal infrastructure
The Netherlands has one of the best connected digital infrastructures in the world. Especially in and around Amsterdam, there are about sixty data centers. These data centers appear - due to the open nature of the market and lack of oversight of hosting services - to be an important base of operations for illegal practices. The police investigation revealed that part of Anyproxy is hosted in the Netherlands.
On Wednesday, May 7, servers of Anyproxy and other affiliated proxy services worldwide were seized and taken offline. This action marks an important step in the fight against organized cybercrime, dismantling a crucial digital infrastructure of criminals.
Do the check yourself - is your router secure?
It appears that thousands of old routers worldwide, which no longer receive updates, are being misused without the owners' knowledge as digital cover for criminal activities such as phishing and ransomware attacks. Outdated routers are an attractive target for cybercriminals. It is important to check that your router is still supported and that you receive regular security updates. Are you not receiving these? Then it's time to replace your router. If your router is hacked, it can lead to slower Internet, unreliable connections or even the loss of personal data. Cybercriminals can gain access to your network and infect your devices with malware. So make sure your router is always up-to-date and properly secured.
Go through
https://veiliginternetten.nl/doe-je-updates/ after whether your equipment is vulnerable. Companies can visit
https://www.ncsc.nl/documenten/publicaties/2019/mei/01/zicht-op-risicos-van-legacysystemen
Need for stricter legislation
With this operation, the Netherlands is sending a strong signal: our digital infrastructure must not be a safe haven for criminals. To achieve structural effect, better legislation is necessary. The Amsterdam Triangle has already made a clear call to the cabinet on this issue, including the introduction of a mandatory Know-Your-Customer (KYC) policy and the banning of anonymous crypto payments.
U.S. Justice
US prosecutors have indicted three Russians and a Kazakh national for their roles in the criminal proxy services Anyproxy and 5socks.
For more information, visit:
