BRIGHT DATA

Bright Data is an Israeli company which has been in operation since 2014. They are known for their large proxy network, web scraping and unblocking products, datasets, and enterprise web-data infrastructure and are considered a large sized proxy provider. Synthient's Research Team has found proxy resellers such as TorchProxies, LemonClub, and OculusProxies to be providing access to Bright Data. These indirect sales channels highlight a potential risk due to limited downstream regulation or KYC controls.

Bright Data is observed leveraging Bright SDK to source IP addresses. Bright SDK is distributed across Windows, Android, iOS, macOS, Roku, Amazon/Fire TV, LG webOS, Samsung TV, and Unity, is classified as App Monetization, and has been observed in EarnApp, DriverHub, and Virtual Fireplace HD.

Synthient's Research Team assigns a LOW risk score to Bright SDK based on a randomized sample of consent practices observed in the wild.

Provider relationships

Bright SDK lists EarnApp and BrightVPN among its operated apps.

Yara Rules

rule Proxyware_BrightSDK_Android_Eapx
{
    meta:
        description = "Bright SDK `com.android.eapx` consent-gated Android peer implementation"
        provider    = "BrightData"
        sdk         = "BrightSDK"
        platform    = "Android DEX/APK"
        variant     = "eapx"
        category    = "proxyware"
        author      = "Synthient"
        date        = "2026-08-27"
        confidence  = "high"
        intel_family = "bright"
    strings:
        $api     = "Lcom/android/eapx/BrightApi;" ascii
        $consent = "CUSTOM_PEER_CONSENT_DIALOG_SETTINGS_KEY" ascii
    condition:
        (uint32(0) == 0x0a786564 or uint32(0) == 0x04034b50) and
        filesize < 60MB and
        all of ($api, $consent)
}

This rule identifies an SDK family. A match alone does not establish malicious activity or the absence of consent.

Indicators of Compromise

File Hashes

Domains

IP Addresses