GEONODE

Geonode is a Singapore company whose exact launch date was not verified from a primary source. They are known for residential, ISP, and datacenter proxies and web-data tools and are provisionally considered a medium sized proxy provider based on their advertised 7.5 million monthly active residential IPs. Synthient's Research Team verified that a reseller program is advertised but did not verify a named downstream reseller in the reviewed corpus. Company identity · Network scale.

Geonode is observed leveraging Repocket and GeoNodeSDK to obtain IP addresses, with the SDKs distributed across Android, iOS/Flutter, Windows, macOS, and Linux/Electron. The Repocket and GeoNodeSDK components are classified as Pay-Bandwidth / App Monetization and can be observed in the Repocket app and its desktop peer client. SDK and app associations do not imply that every installation shares the same consent flow.

Synthient's Research Team has not assigned a HIGH, MEDIUM, or LOW risk score to the combined Repocket and GeoNodeSDK corpus because no randomized sample of disclosure, affirmative consent, and revocation across host applications was completed.

Provider relationships

Geonode identifies Repocket and Zenshield as networks it operates; Zenshield also describes supplying Geonode.

Yara Rules

rule Proxyware_Repocket_MultiPlatform_DartPeer
{
    meta:
        description = "Repocket Dart peer generation shipped in Flutter hosts on Android and iOS"
        provider    = "Geonode"
        sdk         = "Repocket"
        platform    = "Flutter AOT (ELF / Mach-O / iOS binary)"
        variant     = "dart-peer"
        category    = "proxyware"
        author      = "Synthient"
        date        = "2026-08-27"
        confidence  = "high"
        intel_family = "repocket"
    strings:
        $dart      = "package:dart_peer_repo/dart_sdk.dart" ascii
        $dart_main = "package:dart_peer_repo/src/P2P/main_socket.dart" ascii
        $dart_auth = "P2PS-MainSocket -> Authentication" ascii
        $dart_socks = "RequestHandlerSocket -> Socks5 request" ascii

        $create  = "peer/createPeer" ascii
        $handler = "socketReqHandlerPort" ascii
    condition:
        (uint32(0) == 0x464c457f or
         uint32(0) == 0xfeedfacf or uint32(0) == 0xcffaedfe or uint32(0) == 0xcafebabe or uint32(0) == 0xbebafeca or
         uint32(0) == 0x04034b50) and
        filesize > 256KB and filesize < 250MB and
        $dart and $dart_main and
        2 of ($dart_auth, $dart_socks, $create, $handler)
}

This rule identifies an SDK family. A match alone does not establish malicious activity or the absence of consent.

Indicators of Compromise

File Hashes

Domains

IP Addresses