GETGRASS

GetGrass is a Canadian-origin company which has been in operation since 2023. They are known for residential web-data collection, AI training datasets, and rewarding users for unused bandwidth and are considered a large sized proxy provider. Synthient's Research Team found no confirmed third-party proxy reseller providing access to GetGrass in the reviewed corpus; its public model instead supplies undisclosed institutional data customers through the first-party Grass Network. The lack of visibility into those downstream customers may create regulation or KYC risk.

GetGrass is observed leveraging its own GetGrass / Wynd node SDK to source IP addresses, with the SDK distributed across Android, Windows, macOS, Linux, and Chromium browsers. The GetGrass SDK is classified as Pay-Bandwidth and can be observed in Grass for Android, Grass Desktop Node, and the Grass Lite and Community browser nodes.

Synthient's Research Team assigns a LOW risk score to GetGrass SDK based on a randomized sample of consent practices observed in the wild. The reviewed software is distributed as dedicated, first-party bandwidth-sharing software with account enrollment, visible connection state, and pause controls; operational proxy-exit and ISP-policy risks remain.

Research record

Reseller Graph

The highlighted node is the provider named on this card. Reseller arrows point toward that provider. App, SDK, and supply associations are labeled separately and do not establish ownership.

Yara Rules

rule Proxyware_GetGrass_Android_Package
{
    meta:
        description = "Android package shipping the Grass node: io.getgrass.www host plus the rust_wynd_proxy core"
        provider    = "Getgrass"
        sdk         = "GetGrass"
        platform    = "Android APK"
        variant     = "host-package"
        scope       = "APK container; matches on the stored entry names and resource table"
        category    = "proxyware"
        author      = "Synthient"
        date        = "2026-08-27"
        confidence  = "high"
        intel_family = "grass"
    strings:
        $pkg_dotted = "io.getgrass.www" ascii
        $pkg_path   = "io/getgrass/" ascii
        $lib        = "librust_wynd_proxy.so" ascii
        $rust       = "rust_wynd_proxy" ascii
        $plugin     = "io/getgrass/plugin" ascii
        $kek        = "grass_seed_kek" ascii
        $dek        = "grass_dek.bin" ascii
    condition:
        uint32(0) == 0x04034b50 and
        filesize > 1MB and filesize < 300MB and
        1 of ($pkg_*) and
        2 of ($lib, $rust, $plugin, $kek, $dek)
}

This rule identifies an SDK family. A match alone does not establish malicious activity or the absence of consent.

Indicators of Compromise

File Hashes

Domains

IP Addresses