Proxy.vn’s hidden Tin-Roof datacenter fueling fake accounts and DDoS attack on iStories.media

17 November 2025

The Russian investigative media iStories received a series of Denial of Service attacks in early November 2025. At peak the website was flooded by more than 30.000 IP addresses. Although the attack infrastructure was globally distributed, a large portion of the flooding botnet was geo-located in Vietnam.

As this was the first time that we received this attack signature, we decided to try to identify what infrastructure was operating from Vietnam capable of flooding our servers with thousands of IP addresses coming from both datacenter and mobile networks.

We investigated the sources of the malicious traffic and we discovered that it was originated from several ASNs registered in Vietnam that operate datacenter proxy networks.

A part of the IP addresses came from datacenters, but the floodings also included IP addresses from large fiber to the home (FTTH) and Mobile (4G) providers such as Viettel, Mobifone , Vinaphone or FPT.

We looked into the large actors adverting proxy services in Vietnam and managed to untangled the myriad of associated brands and resellers offering such services. The result: we managed to identify what we strongly believe is the main proxy service used in the attack: Proxy.vn

Proxy.vn / Topproxy.vn (run by Hà Minh Trọng and Hoàng Văn Chung).

• (CURRENT) Che 8 Residential Group, An Tuong Ward, Tuyen Quang Province – Hoang Chung – 0834 988 888
• No. 133, Lac Hong Street, Quarter 6, Phu Ninh Commune, Phu Tho Province, Vietnam.

Who runs Proxy.vn?

Proxy[.]vn is run by Hoàng Văn Chung and Hà Minh Trọng a couple of hours drive from Hanoi. After operating the infrastructure in the Phu Ninh Commune, Proxy VN expanded its hosting and proxy business in Tuyen Quang Province (Area 8). The business offers both proxies and leases hosting servers.

Apart of operating a “DIY datacenter”, the company announces its network prefixes behind LienVPS, a ASN registered in the resort village of Hòa Hội and cozy shelter of several Proxy projects. Their proxies are also run in coordination with other providers as TrumVPS.

Proxies for “Making Money Online”

Proxy.vn provides proxy infrastructure to other resellers working in the “Make Money Online” MMO scene. Typically these operators specialize in social media marketing (SMM), selling fake followers, affiliate advertisement or other fraudulent advertisement activities.

During our research we found out that Proxy.vn works with several MMO operators specialized in “social-media automation”. For example, Hanel Proxy runs “Hanel Social”, the associated business that is specialized in selling fake accounts. Hanel Proxy and Hanel Social are run by business partner: Nguyễn Mạnh Chiến We found out that “Best Proxy” provides proxies for their “Best Clone” service, that also focuses on fake media followers.

The forensic evidence suggests that Proxy.vn does not just provide proxy services but it is also connected with the MMO-scene that creates and sells fake follower social media accounts.

Multiple Brands

Proxy VN runs several brands to promote their services including Top Proxy, Proxy HT and keeps close connections with TrumVPS proxy service Proxy Cheap and 2Proxy.

Proxy VN is part of a large ecosystem of proxy providers that benefit from an enviroment where connectivity and IP space are easily available.

bestproxy.vn. (Nguyen Thi Hoa)  

hanelproxy.vn. (Nguyễn Manh Chiến) 
cuahangproxy.com (HO HUU DAT)
proxyht.com. (Proxy SV)
proxy.vn. (Proxy SV)
topproxy.vn. (Proxy SV)
--
hanelvps.vn (Nguyễn Manh Chiến)
hanelsocial.vn (Nguyễn Manh Chiến)
hanelproxy.vn (Nguyễn Manh Chiến)
hanel.pro (Nguyễn Manh Chiến)
hanelclone.vn (Nguyễn Manh Chiến)
bestclone.vn. (Nguyen Thi Hoa)
--
proxycheap.vn (Trần Phú Hải / TrumVPS) 
2proxy.net (Trần Phú Hải / TrumVPS) 

A “nhà kho tôn” warehouse infrastructure for cybercrime

A fascinating element of Proxy VN is how in less than a few years they have moved from selling online gaming cheats in a cybercafe to build their own warehouse datacenter. Thanks to the local spirit of the Do-it-yourself and not following very strict safety standards, Proxy VN found a business opportunity in reselling access to hundreds of Fiber and mobile connections from Viettel. The result is that Proxy VN offers an almost untraceable infrastructure that can be weaponized for Dark SEO, Affiliate Marketing, Denial of service attacks. All from a warehouse tin roof datacenter: nhà kho tôn datacenter.

We managed to trace the activity of the members of Proxy.vn to 2021 (although their different legal status were not acquired until 2024-2025).

In that time, Hà Minh Trọng run a cybercafe for gamers at No. 133, Lac Hong Street, Quarter 6, Phu Ninh Commune. During that time he was leasing out bot farms for games as “The Rise of Kingdoms”.

During late 2023, the infrastructure was moved to the Tuyen Quang Province, one hour drive from the cybercafe. In Tuyen Quang, Proxy VN’s business owner Hoàng Văn Chung built a hidden facility where its proxy and hosting services are located.

During our investigation we soon found out that the Proxy VN was not just running services from their Tuyen Quang hidden datacenter and that their proxies were running in infrastructure of LienVPS, TrumVPS and Japan-USA hosting provider DDPS.

What caught our inmediate attention was that a large portion of the datacenter network prefixes were announced via one single ASN “LienVPS”. Behind the ASN, we found Proxy VN, Proxy HT and a full gang of proxy associates.

Lien VPS (AS15188/AS150820) features all the signals of a “shell setup”: it lacks webpage, proper contact details and it was inmediately populated by clients in the same “Proxy” industry. Lien also runs Lien Cloud and Lien Electronic Wave Technology, the web-less companies were useful vehicles to obtain IP space from VNNIC.

At the time of this writing Lien VPS and associated companies are temporary suspended in the Vietnamese business registry. Is this a dead-end?

We dived a bit deeper and we found that “Lien VPS” sourced their IP space using the “VPSTTT Group”, a hosting provider run by Trạng Tô Thanh (TTT).

VPSTTT was formed in early 2022 as a specialized provider for network resources to proxy providers i.e. harvesting and routing IP space obtained from VNNIC. VPSTTT was responsible of obtaining IP space for “Misterious Lien” from VNNIC.

aut-num: AS149072 as-name: VPSTTT-AS-VN last-modified: 2022-01-11 
aut-num: AS150820 as-name: LIENVPS-VN last-modified: 2023-01-30 (suspended)
aut-num: AS150862 as-name: MAYTINHVPSTTT-VN last-modified: 2023-07-17 
aut-num: AS151883 as-name: LIENCLOUD-VN last-modified: 2023-12-15 (suspended)
aut-num: AS153404 as-name: VNMCVLVNCLOUD-VN last-modified: 2024-11-11(suspended)
aut-num: AS153408 as-name: VNMCVLPYCLOUD-VN last-modified: 2024-11-11 (suspended)

At the time of this writing, Lien VPS IP ranges remain active and used by proxy services as (Proxy HT).

VPSTTT upstream connectivity

LienVPS IP space (Proxy HT)

Suspended LienVPS

The “Proxy MMO entrepreneurs”

Conclusion

Our forensic investigation identified the infrastructure in Vietnam used to carry out attacks against istories.media. The attacks were conducted through the Proxy VN service. Proxy VN operates its proxy network from a concealed datacenter in Tuyên Quang Province as well as from facilities run by the “shelter” hosting ans transit provider LienVPS. The entity VPSTTT played a key role in securing IP address allocations for LienVPS and its proxy operators through the Vietnamese regulator VNNIC. To further expand its pool of IP addresses, Proxy VN also collaborates with TrumVPS.

We also found that Proxy VN is closely linked to a cluster of MMO-related businesses involved in black-hat SEO and fake social-media marketing operations.

Prior to publication, we reached out to Proxy VN, TrumVPS, VPSTTT and VNNIC to share our findings and request comment. None of them responded.

Appendix