DATAIMPULSE

DataImpulse is an Estonia-linked company, with service terms naming US-registered Softoria LLC, which has been in operation since 2022. They are known for low-cost residential, mobile, and datacenter proxies, granular targeting, and reseller APIs and are considered a medium sized proxy provider. Synthient's Research Team verified white-label resale and sub-user APIs but did not identify a named downstream reseller in the reviewed dataset. These indirect sales channels highlight a potential risk due to limited downstream regulation or KYC controls.

DataImpulse is observed leveraging TraffMonetizer to source IP addresses. TraffMonetizer is distributed across Windows, Android, and Linux, is classified as Pay-Bandwidth and App Monetization, and has been observed in Screen Mirroring, modified Netflix builds, and Video Downloader for Facebook.

Synthient's Research Team assigns a HIGH risk score to TraffMonetizer based on a randomized sample of consent practices observed in the wild.

Research record

Reseller Graph

The highlighted node is the provider named on this card. Reseller arrows point toward that provider. App, SDK, and supply associations are labeled separately and do not establish ownership.

Yara Rules

rule Proxyware_TraffMonetizer_Android_RelayEngine
{
    meta:
        description = "TraffMonetizer Android controller-selected TCP/UDP reverse relay SDK"
        provider    = "DataImpulse"
        sdk         = "TraffMonetizer"
        platform    = "Android DEX/APK"
        variant     = "android-sdk"
        category    = "proxyware"
        author      = "Synthient"
        date        = "2026-08-27"
        confidence  = "high"
        intel_family = "traffmonetizer"
    strings:
        $sdk        = "com/traffmonetizer/sdk/TraffmonetizerSdk" ascii
        $cmd_pkg    = "com.traffmonetizer.sdk.repository.api.command." ascii
        $balancer   = "blnc.traffmonetizer.com" ascii
        $controller = "srv.traffmonetizer.com" ascii

        /* Wire verbs of the command envelope. */
        $connect  = "CONNECT_V2" ascii
        $udp_bind = "UDP_BIND_MESSAGE" ascii
        $marker   = /TraffmonetizerSDK-v1\.2\.(1|3|4|5|6|8|9|10|11)_(release|sdkRelease|internalRelease)/ ascii
    condition:
        (uint32(0) == 0x0a786564 or uint32(0) == 0x04034b50) and
        filesize < 200MB and
        1 of ($sdk, $cmd_pkg) and
        2 of ($balancer, $controller, $connect, $udp_bind, $marker)
}

This rule identifies an SDK family. A match alone does not establish malicious activity or the absence of consent.

Indicators of Compromise

File Hashes

Domains

IP Addresses