17 November 2025
– A vast IP-rotation system that enables anonymous high-volume traffic, DDoS and manipulation of social media
Qurium Media Foundation has completed a forensic investigation into the Distributed Denial of Service (DDoS) attacks targeting the Russian investigative media outlet iStories in early November 2025. The investigation links the attacks to Proxy.vn, a Vietnamese proxy network built to exploit residential and mobile internet infrastructure at national scale.
During the peak of the attacks, more than 30,000 IP addresses—from datacenters, fiber-to-the-home networks, and major mobile operators—were used to overwhelm the website.
Qurium has attributed the attacks to Proxy.vn, a proxy service operated by Hoàng Văn Chung and Hà Minh Trọng. Proxy.vn runs a vast IP-rotation system that enables anonymous high-volume traffic, DDoS activity, and coordinated manipulation of online social media platforms.
Qurium has located the previously undisclosed tin-roof warehouse datacenter in Tuyên Quang Province. This facility aggregates hundreds of residential and mobile internet connections from large Vietnamese ISPs, enabling activities that appear to originate from real user networks.
Proxy providers make attribution of attacks significantly harder and allows their operators and their clients to mask harmful or illegal activity behind what it looks like legitimate consumer IP space.
A central structural finding is how proxy operators in Vietnam secured large volumes of Vietnamese IP address space. The entity VPSTTT, run by Trạng Tô Thanh, acted as the broker obtaining IP blocks from the national regulator VNNIC. These were routed through LienVPS, a shell-like hosting and transit provider.
“The investigation exposes one more commercial proxy infrastructure that enables cyberattacks, cross-border information manipulation, and large-scale social-media deception. The use of residential and mobile IPs poses a growing challenge for both platform integrity teams and national regulators”, says Tord Lundström, Qurium’s Executive Director.
Proxy.vn, TrumVPS, VPSTTT and the Vietnam Internet Network Information Center were contacted ahead of publication but did not respond.
Forensic report: Proxy.vn’s hidden Tin-Roof datacenter fueling fake accounts and DDoS attack on iStories.media
Contacts
Digital forensics: Tord Lundström <t at virtualroad.org> Technical Director
Media: Clara Zid <info at virtualroad.org> Media and Outreach Manager