LunaProxy Shut Down (Jan 2026): What Happened & Alternatives

If you are here to compare LunaProxy's prices against ours, there is no longer a comparison to make.

LunaProxy has not been operating since 28 January 2026. On that date Google's Threat Intelligence Group took legal action against IPIDEA, the Chinese proxy network LunaProxy resold, following findings that the network had been used to operate major botnets. LunaProxy was one of more than ten Hong Kong-incorporated brands fronting the same infrastructure. Its domain no longer resolves — we checked lunaproxy.com against both Google and Cloudflare public DNS while updating this article, and there is no A record.

We are Geonode, and we sell residential, datacenter, ISP and mobile proxies. LunaProxy was a competitor, which makes this an article we have an obvious interest in writing, and you should read it that way. So two commitments up front: every factual claim below is attributed to its source and checkable, and we are not going to use a competitor's shutdown as a sales pitch. The genuinely useful part of this page is the second half — the questions that would have surfaced this risk in advance, which apply to us exactly as much as they applied to them.

What follows: what actually happened and who says so, what it means if you had a prepaid balance, verified pricing for two providers that are still operating, and the vetting checklist worth running before you send any proxy vendor money.

What Happened to LunaProxy

The facts, attributed. Where this article states an allegation rather than an established fact, it says so.

The Action

On 28 January 2026, Google's Threat Intelligence Group announced action against IPIDEA, described as one of the largest residential proxy networks in the world. As reported by Proxyway, the action had three parts: legal proceedings to take down public-facing domains and command-and-control infrastructure, sharing technical intelligence on IPIDEA's SDKs with platforms, law enforcement and researchers, and configuring Google Play Protect to warn users about and remove apps containing IPIDEA components.

Who Was Affected

IPIDEA is a Chinese company that controls or is related to more than ten Hong Kong-incorporated brands selling proxy services. The brands named in reporting on the action include 360Proxy, 922Proxy, ABC Proxy, Cherry Proxy, IP2World, IPidea.io, LunaProxy, PIA S5 Proxy, PyProxy and TabProxy.

That list is the part worth pausing on. A customer of any one of those brands would reasonably have believed they were buying from an independent company. They were buying access to the same underlying network under different branding — which means the diversification some users thought they had by splitting spend across vendors was not real.

The Allegations

According to the reporting, IPIDEA's network facilitated the BADBOX 2.0, Kimwolf and Aisuru botnets, and over 550 threat groups used IPIDEA proxies for malicious activity. Vulnerabilities in the infrastructure reportedly allowed botnet operators to reach and recruit other devices on the local networks where proxy nodes were running.

That last point is the technically significant one, and it is worth stating plainly: it describes proxy endpoints sitting inside people's home networks acting as a route to the other devices on those networks. That is a materially different risk profile from bandwidth sharing as normally described.

Where the Uncertainty Sits

At the time of the reporting, some IPIDEA-related websites were still reachable and the real effect on the networks themselves had not been measured. What we can confirm independently is narrow and specific: as of this update, lunaproxy.com returns no A record from Google or Cloudflare public DNS.

We are not in a position to verify Google's technical findings ourselves, and we are not asserting them as our own. They are attributed above because attribution is the honest way to report someone else's investigation.

What This Means If You Were a Customer

Practical steps, in order of urgency.

If You Have an Unused Balance

Proxy services are almost universally prepaid, so a shutdown means customers are unsecured creditors of a company that has stopped operating. Realistically, recovery prospects are poor.

Worth trying anyway: if you paid by card within your issuer's chargeback window, a chargeback for services not rendered is the most likely route to recovery. Gather your invoices, the dates, and evidence the service stopped. If you paid by cryptocurrency or bank transfer, there is generally no equivalent mechanism.

If You Had Infrastructure Pointed at Them

Rotate any credentials that were configured in their dashboard or passed through their endpoints. Not because we know of a specific compromise — we do not — but because credentials that traversed infrastructure now subject to a law-enforcement-adjacent action are exactly the kind of thing you rotate as a matter of routine rather than as a reaction.

Check your own logs for the period, and check whether any of your automation is still retrying against a dead endpoint and silently failing.

If You Have Their SDK in a Product

This is the one to treat as urgent. If your application bundled an SDK from any brand in that list — typically monetisation SDKs that share a user's bandwidth in exchange for revenue — Google Play Protect has been configured to warn about and remove apps containing IPIDEA components. That is an app-store problem, not just a vendor problem, and it needs looking at today rather than this quarter.

If You Were Considering Them

Several of those brands still rank well in search and are still recommended in listicles that have not been updated. A comparison article published before February 2026 will happily quote you their pricing. Check that a provider is currently operating before you evaluate what they charge — which sounds too obvious to state until you notice how much of this market's content is stale.

The Verified Alternatives

What we can state from source, for providers that are operating. All figures from the vendors' own live pricing pages at the time of writing and subject to change — check before buying.

	Geonode	IPRoyal
Residential entry	$0.79/GB	$7.00/GB (1 GB)
Residential at volume	$0.50/GB at 100 GB, $0.27/GB at 1 TB	$1.75/GB from 10 TB
Datacenter	$0.14/GB, billed by traffic	Per IP
ISP / static	$1.25/IP	Available
Unlimited residential	$1,800/month	—
Free allowance	1 TB for new accounts	—
Traffic expiry	Standard monthly terms	Does not expire

Reading the Table

Our entry rate is the lower of the two and that is not the interesting row. The interesting row is the last one.

IPRoyal's non-expiring traffic is a genuine structural advantage that we do not match, and it is worth more than the headline rate for a large class of users. Their residential pricing terms state the proxies work for as long as it takes you to use the traffic — buy 30 GB, spend it across a year, lose nothing.

Most of this market, us included, works on monthly terms where unused allowance expires at the billing date. For steady monthly usage that is fine and the cheaper rate wins comfortably. For bursty or seasonal usage it is not: 30 GB of non-expiring traffic at $7.00/GB costs $210 in total, while a metered monthly plan sized for your peak week and mostly idle for the other three costs more than that across a year, even at a fraction of the rate.

So, from a vendor at the cheap end of the table: work out your usage shape before your usage volume. If your consumption is lumpy and annual rather than steady and monthly, a higher rate on non-expiring traffic may genuinely cost you less than we would.

The datacenter row is where our pricing is unusual. Most of the market bills datacenter proxies per IP; we bill by traffic at $0.14/GB. Neither model is better in the abstract — per-IP wins when you push a lot of data through few addresses, per-GB wins when you need many addresses and move little through each. Divide your monthly gigabytes by the number of distinct addresses you need, and that ratio picks the model.

A Note on the Wider Price Range

Published residential rates across the market span roughly $0.79 to $7.00 per gigabyte at entry level. That is close to a ninefold spread for a product described in near-identical language everywhere.

The correct reaction to a very low headline rate is not enthusiasm but curiosity about what is different — pool size, geographic depth, how heavily addresses have been used, support responsiveness, compliance documentation, and, as this article has cause to note, how the network was assembled in the first place. That applies to our $0.79 as much as to anyone's.

Why Per-GB Price Is the Wrong Headline

The section that changes the conclusion, and it is the reason a table like the one above is less useful than it looks.

Every comparison in this market ranks providers by dollars per gigabyte, because it is the number on the pricing page. It is not the number that determines what you spend.

The Arithmetic

Two providers, same target.

Provider A: $1.00/GB, succeeds on 50% of requests. Provider B: $2.50/GB, succeeds on 95%.

A looks 60% cheaper. But a failed request consumes paid bandwidth exactly like a successful one — the connection was made, the block page or challenge came back, you were billed. Collecting 1,000 successful pages needs about 2,000 attempts from A and about 1,053 from B.

At 500 KB per page, A costs roughly $1.00 per 1,000 successes and B roughly $1.32. The 60% gap has collapsed to 24%.

Drop A's success rate to 30% and it needs 3,333 attempts, costing $1.67 per 1,000 successes against B's $1.32. The cheaper provider is now the more expensive one, and neither pricing page contained the information that would have told you.

Why Nobody Can Quote You This

Success rate is target-specific. A network that performs superbly against one marketplace may do poorly against another, and both change when a target updates its detection. No provider can honestly tell you their success rate on your workload, ours included, and any that quotes a single figure is quoting one measured against targets they chose.

This is why published benchmarks are directional at best, and why the test described later matters more than every table in this article.

What It Does Not Mean

Price is not irrelevant. Once two providers both work acceptably on your target, the cheaper one is straightforwardly better and you should take it.

The point is the sequence: establish that it works, then compare price. Reversing that order is how people end up migrating three times in six months, and it is the single most common expensive mistake in this market.

Terms That Move the Bill More Than the Rate

Four contract terms that regularly matter more than a difference of a dollar per gigabyte, and none of which appear in comparison tables.

1. Does Unused Traffic Expire?

Covered above and worth repeating because it is the largest of the four. Most subscriptions expire unused gigabytes monthly. IPRoyal states theirs do not.

For lumpy workloads this single term can outweigh a fourfold difference in rate. Establish your usage shape first.

2. Is the Displayed Price Promotional?

Several providers in this market display heavily discounted rates as the default view, sometimes with the regular price shown alongside and sometimes not. Discounts are legitimate; a comparison built from them ranks vendors by who is running the deepest sale this week, which is not a durable property.

Ask two questions explicitly: what does this cost at renewal, and is this rate contractual or promotional. A vendor who answers clearly has told you something useful about how they will treat you later.

3. What Counts as Billable Traffic?

Failed requests, retries, connection overhead, redirects. Most providers bill all of it, which is the direct link back to the success-rate arithmetic above. Some bill only successful requests on certain products. On a difficult target this can move effective costs substantially.

4. What Are the Minimums and the Refund Terms?

Minimum top-up, minimum commitment, whether unused balance is refundable, and what happens if the service does not work for you. Proxy services are prepaid, which means you are extending credit to the vendor, not the other way round.

The One That Is Not About Money

How the network was sourced. Residential proxies route through real consumer connections, and how consent was obtained from the people whose connections those are is a fair question to put to any provider in this market, including us. A vendor who cannot answer it clearly has told you something. For anyone operating under a compliance regime, this is the first question rather than the last.

Questions to Ask Before You Pre-Pay

Proxy services are almost universally prepaid. That makes vendor reliability a financial question as well as a technical one, and it is worth a few minutes before the first payment rather than after.

The Reachability Checks

Does the site load, consistently, over a few days? A single failed load means nothing. A pattern is worth noticing.

Is there a status page, and does it show real history? A status page that has never recorded an incident is either a very good service or a decorative one.

Does support answer before you are a customer? Send a specific technical question — not "do you have UK proxies" but something requiring a real answer, like how sticky sessions behave when an address drops mid-session. The quality and speed of the reply is the best available predictor of what happens when something breaks at two in the morning.

Is there a company behind it? A registered entity, an address, named people. Absence is not proof of anything, and presence is a meaningful signal in a market with real churn.

The Commercial Checks

Start with the smallest possible commitment. Free tier, trial, or minimum top-up. Never begin with an annual plan, whatever the discount — the discount is priced to compensate for the risk you are taking on.

Confirm the refund position in writing before paying, not after.

Check whether traffic expires, in writing.

Check the renewal rate, in writing.

The Test Purchase

Buy the minimum. Run your real workload. Measure. Only then commit to volume.

The discount on a large prepayment is rarely worth the exposure until you have established that the service does what you need on your specific targets — which, as the previous section argued, is something no pricing page can tell you.

This advice costs us money. Our own 1 TB free allowance for new accounts exists precisely so this step is possible without a purchase, and we would rather you used it thoroughly than committed early on a rate.

The Test That Settles It

An afternoon of this beats every comparison article on this subject, this one included.

Step One: Check Whether You Need Residential at All

Before comparing residential providers, run a few hundred requests against your real target through a datacenter proxy. If you are succeeding above roughly 95%, your target does not check address origin and you have just cut your proxy budget by most of an order of magnitude.

An enormous quantity of the web — documentation, public APIs, forums, small and mid-sized sites, most government and academic pages — does not check. Residential is the default purchase in this industry largely because it is the default recommendation.

This step costs almost nothing at $0.14/GB and it is skipped constantly.

Step Two: Set Up Two or Three Candidates in Parallel

Use free tiers and minimum purchases. Same target list, same volume, same concurrency, same time of day — that last one matters more than people expect, because residential pool composition shifts with when real users are online.

Step Three: Record Four Numbers Per Provider

Successful responses, defined as containing the content you actually wanted.
Bandwidth consumed, including failures.
Median and 95th-percentile latency.
Geographic accuracy — spot-check that requests genuinely appear from where you asked.

Step Four: Divide

Bandwidth consumed × price per GB, divided by successful responses. That is your cost per successful request, and it is the only figure that compares providers meaningfully.

The Trap in Counting Successes

Count by checking for content you expect, not by checking for HTTP 200.

The characteristic failure in this field is a plausible page with the wrong contents — a challenge page, a soft block, a regional variant, an empty result set that looks like a legitimately empty result set. A success counter that trusts the status code will report excellent numbers while collecting nothing, and that error survives for a remarkably long time before anyone notices.

When Neither of Us Is Right

Against our own interest, and it covers more readers than it should.

Your target does not check address origin. Test datacenter first. The saving is most of an order of magnitude and a large share of the web genuinely does not care.

You are making a handful of requests. Rate limiting responds to volume and pattern. Fifty requests across a day look like a person. Buying proxies for a small job solves a problem you do not have.

You control the target. Load-testing your own service, monitoring your own endpoints. Route directly and measure reality rather than reality plus a proxy hop.

You need a persistent identity. Account work, anything with a login. Rotating residential is actively wrong — an account appearing from a new city each session looks worse than one that never moved. Static ISP addresses are the product, from us or anyone.

Your usage is lumpy and annual. Non-expiring traffic at a higher rate may cost less in total than our cheaper metered plan. IPRoyal offers that and we do not.

You need enterprise compliance documentation and a named account manager. The providers at the top of the price range are built for that. We are not going to win that comparison and would rather say so.

The problem is not your address. Missing headers, absent cookies, a fingerprint that gives away automation, a request rate no human would produce. All produce blocks that look identical to address-based blocks, and none are fixed by better proxies.

The page is rendered by JavaScript. No proxy turns an empty shell into content. You need a headless browser.

The data is available another way. An official API, a bulk download, a public dataset. Checking takes ten minutes and frequently ends the project before it starts.

You have not read the terms. Automated collection is often contrary to a site's terms of service, and personal data carries obligations regardless of how it was collected. Proxies change what a site can observe; they do not change what you agreed to.

Wrapping Up

This started as a price comparison and stopped being one, because one side of it no longer exists.

On LunaProxy: it has not operated since 28 January 2026, after Google's action against the IPIDEA network it resold — a network that, according to that reporting, had been used to run major botnets and was reachable by hundreds of threat groups. If you had a balance, a card chargeback is the realistic route. If you had their SDK in a shipped application, that is the urgent item. If you find an article still quoting their pricing, you have learned something about how quickly this market's content goes stale.

On the vetting question, which is the part that transfers: more than ten brands turned out to be one network. Anyone who split spend across several of them believing they had redundancy did not have it. The question that would have surfaced that — whose network is this actually, and how was it assembled — is the same question worth putting to us, and any provider who cannot answer it plainly has told you something.

On choosing a replacement: the per-gigabyte rate is the wrong headline. Failed requests consume paid bandwidth exactly like successful ones, so a low rate against a target where you succeed half the time is not the bargain it looks like. Check whether unused traffic expires before you check the rate — IPRoyal's non-expiring traffic at $7.00/GB genuinely beats a cheaper expiring plan, including ours, for anyone whose usage is seasonal. And spend ten minutes establishing whether you need residential proxies at all, because datacenter at $0.14/GB works on a large share of the web.

We publish among the lowest rates in this market and we are still telling you to test datacenter first, to ask us how our network was sourced, and to start with the minimum purchase. A competitor's shutdown is not a reason to buy from us. It is a reason to ask everyone harder questions, and we would rather be on the receiving end of those than benefit from nobody asking.

LunaProxy Is Gone: What Happened and What to Use