ASTROPROXY

AstroProxy is an Armenian company operated by Cyberzilla LLC which has been documented in operation since at least 2023; the exact launch date was not verified. They are known for residential, mobile, and datacenter proxies and are provisionally considered a medium sized proxy provider based on their advertised 50-million IP pool. Synthient's Research Team did not verify a named downstream reseller in this review. AstroProxy states that customers undergo KYC checks, but this does not independently verify consent in every supplying application. Operator · Terms · Published network scale.

AstroProxy is observed leveraging Peer2Profit / StarLet to obtain IP addresses, with the SDK distributed across Android, Windows, Linux, and macOS. The Peer2Profit / StarLet SDK is classified as Pay-Bandwidth / App Monetization and can be observed in the Peer2Profit Android app, the Linux p2pclient, and a reusable Windows SDK DLL. VirusTotal's parent-file relationship links the reviewed Java engine to Peer2Profit 3.4.6; this is an SDK supply association, not proof of corporate ownership.

Synthient's Research Team assigns a provisional MEDIUM risk score to the reviewed Peer2Profit corpus based on a targeted static and VirusTotal sample of consent controls, not a randomized survey. The Android app includes account-based participation and visible service controls; the Windows DLL exposes start, stop, and active-state functions for a host application to call. Those controls allow participation to be managed, but the DLL alone cannot establish what a host disclosed or whether its user opted in.

Research record

Reseller Graph

The highlighted node is the provider named on this card. Reseller arrows point toward that provider. App, SDK, and supply associations are labeled separately and do not establish ownership.

Yara Rules

rule Proxyware_Peer2Profit_MultiPlatform_StarLetCore
{
    meta:
        description = "Peer2Profit StarLet controller-directed backconnect engine"
        provider = "AstroProxy"
        sdk = "Peer2Profit"
        platform = "Android DEX/ELF, Linux ELF, Windows PE, macOS Mach-O"
        variant = "StarLet"
        category = "proxyware"
        author = "Synthient"
        date = "2026-08-28"
        confidence = "high"
        intel_family = "peer2profit"
    strings:
        $keepalive = "$tar1et" ascii
        $context = "StarLet-Context:" ascii
        $agent = "Proxy-Agent: StarLet/" ascii
        $auth = "Proxy-Authorization: basic" ascii
        $api = "/api/proxy/nodes/get" ascii
        $timeout = "HTTP/1.0 522 Connection Timeout" ascii
    condition:
        (uint16(0) == 0x5a4d or uint32(0) == 0x464c457f or
         uint32(0) == 0xfeedfacf or uint32(0) == 0xcffaedfe or
         uint32(0) == 0x0a786564) and
        filesize > 40KB and filesize < 300MB and
        all of ($keepalive, $context, $agent, $auth) and
        1 of ($api, $timeout)
}

This rule identifies an SDK family. A match alone does not establish malicious activity or the absence of consent.

Indicators of Compromise

File Hashes

Domains

IP Addresses