IPCOLA

IPCola is a Meson/GagaNode-linked company of unverified jurisdiction which has been in operation since 2023. They are known for non-KYC residential proxies, cryptocurrency payments, and IP supply from IoT, desktop, and mobile devices and are considered a medium sized proxy provider. Synthient's Research Team did not identify a named downstream reseller in the reviewed dataset. The opaque corporate ownership and lack of customer KYC highlight a potential abuse and accountability risk.

IPCola is observed leveraging GagaNode to obtain large swaths of IP addresses. GagaNode is distributed across Android, Windows, macOS, Linux/IoT, and embedded devices, is classified as Malware / high-risk Pay-Bandwidth proxyware, and has been observed in Nexus, Rockchip-based TV boxes, and DualSafe.

Synthient's Research Team assigns a HIGH risk score to GagaNode based on a randomized sample of consent practices observed in the wild.

Research record

Reseller Graph

The highlighted node is the provider named on this card. Reseller arrows point toward that provider. App, SDK, and supply associations are labeled separately and do not establish ownership.

Yara Rules

rule Proxyware_Gaganode_Android_MinerSdkEngine
{
    meta:
        description = "Gaganode MinerSdk Android TCP/UDP proxy and remote-command engine"
        provider    = "IPCola"
        sdk         = "Gaganode"
        platform    = "Android DEX/APK"
        variant     = "minersdk"
        category    = "proxyware"
        author      = "Synthient"
        date        = "2026-08-27"
        confidence  = "high"
        intel_family = "gaganode"
    strings:
        $tcp = "com/gaganode/sdk/node/proxy/proxy_server_tcp_client" ascii
        $udp = "com/gaganode/sdk/node/proxy/proxy_server_tcp_udp_client" ascii
        $cmd = "BuildProxyServerTcpClientCmd" ascii

        $node_conf  = "Lcom/gaganode/sdk/node/node_conf;" ascii
        $remote_cmd = "Lcom/gaganode/sdk/node/remote_cmd/a;" ascii
        $tcp_msg    = "Lcom/gaganode/sdk/common/tcp_msg/tcp_msg;" ascii
        $sec_key    = "Lcom/gaganode/sdk/common/tcp_msg/sec_key;" ascii
    condition:
        (uint32(0) == 0x0a786564 or uint32(0) == 0x04034b50) and
        filesize < 100MB and
        1 of ($tcp, $udp, $node_conf) and
        2 of ($cmd, $remote_cmd, $tcp_msg, $sec_key)
}

This rule identifies an SDK family. A match alone does not establish malicious activity or the absence of consent.

Indicators of Compromise

File Hashes

Domains

IP Addresses