INFATICA

Infatica is a Singaporean company, with UK and UAE entities, which has been in operation since 2019. They are known for residential and mobile proxies, scraping APIs, datasets, and app monetization and are considered a medium sized proxy provider. Synthient's Research Team has found proxy resellers such as Proxy-Seller, ProxyMA, and GonzoProxy to be providing access to Infatica. These indirect sales channels highlight a potential risk due to limited downstream regulation or KYC controls.

Infatica is observed leveraging InfaticaSDK to source IP addresses. InfaticaSDK is distributed across Windows, Android, iOS, macOS, and Linux, is classified as App Monetization, and has been observed in Rave / WeMesh, Swipis, and Duboku TV.

Synthient's Research Team assigns a MEDIUM risk score to InfaticaSDK based on a randomized sample of consent practices observed in the wild.

Reseller Graph

The highlighted node is the provider named on this card. Reseller arrows point toward that provider. App, SDK, and supply associations are labeled separately and do not establish ownership.

Yara Rules

rule Proxyware_InfaticaSDK_MultiPlatform_GoAgent
{
    meta:
        description = "Infatica Agent Go core: Noise XX/IK control channel and controller-selected TCP/UDP relay"
        provider    = "Infatica"
        sdk         = "InfaticaSDK"
        platform    = "Windows PE/DLL, Linux/Android ELF, Apple Mach-O"
        variant     = "go-agent"
        category    = "proxyware"
        author      = "Synthient"
        date        = "2026-08-27"
        confidence  = "high"
        reference_elf_sha256 = "527c2d4a9fbdffbf8d316608295ab2c94cc9220c5a890e8a7072d53c4a0e5bd3"
        reference_pe_sha256 = "27aa7cd1aeaacb16e3de97eff34e502ded4ea1b751757beabab132a27802dd07"
        intel_family = "infatica-agent"
    strings:
        /* Two generations of the same Go tree: the standalone agent module and
           the Android SDK repackaging. Both carry the relay entry point. */
        $mod_agent   = "infatica_agent/servers." ascii
        $mod_android = "android_sdk/internal/servers." ascii

        /* Noise handshake progression, logged verbatim by the agent. */
        $noise_xx_send = "XX handshake: sending message 1..." ascii
        $noise_xx_done = "XX handshake: completed successfully!" ascii
        $noise_ik_send = "IK handshake: sending message 1..." ascii
        $noise_ik_done = "IK handshake: completed successfully" ascii
        $noise_frame   = "NoiseConnection.Write: encrypted to" ascii
        $noise_cache   = "noise_key_cache_%s_%s.dat" ascii
        $noise_dir     = ".infatica_noise_cache" ascii

        /* Controller verbs that drive the exit node. */
        $cmd_connect3 = "server=%v: sending CONNECT_V3" ascii
        $cmd_connect4 = "server=%v: TX: CONNECT_V4: partnerID=%v" ascii
        $cmd_slave    = "reqId=%v: slave connection: OPEN_SLAVE sent" ascii
        $cmd_udp      = "server=%v: RX: UDP_COMMUTATE_REQUEST" ascii
        $cmd_status   = "server=%v: RX: BROADCAST_STATUS_REQUEST" ascii
        $cmd_stop     = "server=%v: about to send STOP_NODE_RESPONSE" ascii
        $relay        = "reqId=%v: proxyBetween: %v <-> %v" ascii

        /* The earlier Windows/Linux generation ships the same package without
           the verbose logging, so its Go symbol names carry the evidence. */
        $sym_commreq  = "servers.(*ServerConnection).handleProxyRxCommReq" ascii
        $sym_connresp = "servers.(*ServerConnection).handleProxyRxConnResp" ascii
        $sym_ping     = "servers.(*ServerConnection).handleProxyRxPing" ascii
        $sym_logena   = "servers.(*ServerConnection).handleProxyRxSetLogEnabled" ascii
        $sym_between  = "servers.(*TargetConnection).proxyBetween" ascii
    condition:
        (
            uint32(0) == 0x464c457f or uint16(0) == 0x5a4d or
            uint32(0) == 0xfeedface or uint32(0) == 0xfeedfacf or
            uint32(0) == 0xcefaedfe or uint32(0) == 0xcffaedfe or
            uint32(0) == 0xbebafeca or uint32(0) == 0xcafebabe
        ) and
        filesize > 512KB and filesize < 100MB and
        (
            (1 of ($mod_*) and 2 of ($noise_*, $cmd_*, $relay)) or
            (1 of ($mod_*) and 3 of ($sym_*)) or
            (3 of ($noise_*) and 2 of ($cmd_*, $relay))
        )
}

This rule identifies an SDK family. A match alone does not establish malicious activity or the absence of consent.

Indicators of Compromise

File Hashes

Domains

IP Addresses