Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11U.S. authorities say YunHe Wang administered 911 S5, a botnet-powered residential proxy service that routed customers’ traffic through Windows computers infected with malware. The alleged operation involved other people too, and the charges against Wang are allegations—not proof of guilt. The headline’s “single person” framing therefore needs a qualification: authorities identify Wang as the administrator, not as the sole participant in every part of the scheme.
What was the 911 S5 botnet?
The U.S. Department of Justice (DOJ) describes 911 S5 as a residential proxy service built on malware-compromised Windows computers. A proxy routes a customer’s internet traffic through another device; in this case, the customer’s traffic could appear to come from the residential IP address of an infected computer. The FBI identifies 911 S5 as a botnet and says the service was not a legitimate VPN product.
As an Amazon Associate I earn from qualifying purchases.
In an indictment unsealed on May 24, 2024, prosecutors alleged that Wang and others created and distributed malware from 2014 through July 2022. The infected computers’ IP addresses were then offered to cybercriminal customers for a fee. DOJ says customers used those addresses in financial crimes, stalking, threats, illegal exports, and crimes involving child sexual abuse material. Those descriptions are allegations in the case, not findings that Wang or any particular customer committed those crimes. DOJ’s announcement and indictment summary provide the government’s account.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Was one person behind the whole botnet?
DOJ alleges Wang administered 911 S5, but its account also says “Wang and others” created and disseminated the malware. Describing the case as traced to one person can capture the alleged administrator’s role; it should not be read as proof that he acted alone. Wang, a Chinese national and a citizen of St. Kitts and Nevis by investment, was arrested on May 24, 2024, and charged in a federal indictment.
#1 Best Overall
An indictment is an accusation, not a verdict. DOJ says defendants are presumed innocent unless and until proven guilty beyond a reasonable doubt. The materials cited here do not establish a later final court disposition.
What do the 19 million, $5.9 billion and $99 million figures mean?
The figures refer to different things and should not be added together or treated as a single estimate of money Wang personally took. DOJ reported the following in 2024:
| Figure | What it describes |
|---|---|
| More than 19 million unique IP addresses, including 613,841 U.S. IP addresses | IP addresses associated with compromised devices, according to DOJ. An IP address is not a count of individual people; one person may use multiple addresses, and an address does not by itself identify who used a device. |
| 560,000 fraudulent unemployment insurance claims; confirmed losses exceeding $5.9 billion | A U.S. government estimate, reported by DOJ, of confirmed unemployment-insurance fraud losses associated with claims originating from compromised IP addresses. It is not a figure for Wang’s proceeds and does not establish that he personally caused every claim. |
| More than 47,000 Economic Injury Disaster Loan (EIDL) applications | Applications originating from compromised IP addresses that were included in the government’s review of suspected fraud. DOJ did not describe all of these applications as confirmed fraudulent losses. |
| Approximately $99 million | Alleged proceeds from sales of hijacked proxied IP addresses from 2018 through July 2022, according to DOJ. |
| Approximately $30 million seized; approximately $30 million in additional property identified as forfeitable | Two separate figures in DOJ’s account of the operation: assets seized and additional property identified for forfeiture. “Identified” does not mean the additional property had already been seized. |
The FBI separately says the botnet involved more than 19 million compromised IP addresses in more than 190 countries. Its removal page does not display a publication year. FBI Director Christopher Wray called 911 S5 “likely the world’s largest botnet ever” in DOJ’s May 29, 2024 announcement; that is his characterization, not a directly measured universal ranking. DOJ’s release is the source for its figures and distinctions.
Recommended Free Tools
Did 911 S5 steal $5.9 billion?
No: the $5.9 billion is the government-reported confirmed loss from fraudulent unemployment insurance claims associated with compromised IP addresses. DOJ did not describe it as money Wang received or as the botnet’s revenue. The separate figure for alleged service proceeds is approximately $99 million, covering sales from 2018 through July 2022. The more than 47,000 EIDL applications were in a suspected-fraud review, not a confirmed-loss total.
Rank #3
Was my VPN part of 911 S5, and how do I remove it?
The FBI names six free, illegitimate VPN applications created to connect to 911 S5:
- MaskVPN
- DewVPN
- PaladinVPN
- ProxyGate
- ShieldVPN
- ShineVPN
If you used one of these apps, consult the FBI’s 911 S5 identification and removal guidance for the official steps. The FBI page is the appropriate source for app-specific remediation; do not rely on an unfamiliar paid tool promoted as an FBI-endorsed 911 S5 detector.
An IP address associated with a crime does not, by itself, prove that a particular person committed it. A compromised computer can be used as a proxy without its owner’s knowledge. The FBI’s identification guidance can help determine whether a named app is involved, but an IP address alone is not proof of an individual’s actions.
Free tools Windows power users keep installed
One-click scans. No signup required.
How was 911 S5 disrupted?
According to the FBI, the 911 S5 administrator took the service offline in July 2022, then reconstituted it as Cloudrouter in October 2023. DOJ says the coordinated operation seized 23 domains and more than 70 servers, including infrastructure associated with an effort to reconstitute the service, and closed existing malicious backdoors. Attorney General Merrick B. Garland said the operation brought together international law-enforcement partners to disrupt the botnet and its infrastructure. These are the government’s reported actions; they do not change the distinction between the charges against Wang and a court’s final findings.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
