IPWEB
Providerproxy provider intelligence profile
- Website
ipweb[.]cc
IPWeb is a Hong Kong company operated by Unlimited Connection Technology Co., Limited which states that it has been in operation since 2019. They are known for residential, mobile, ISP, and datacenter proxies and data-acquisition tools and are provisionally considered a medium sized proxy provider based on their advertised 70-million residential IP pool. Synthient's Research Team did not verify a named downstream reseller; shared gateways and branding links are insufficient to establish one. Company identity, history, and scale.
IPWeb is observed leveraging the recovered APsolo / Solo-Ximple client, identified as ipwb, to obtain IP addresses, with the component distributed through an Android parent application. The APsolo / Solo-Ximple client is classified as proxyware; its public marketing name and monetization mechanism were not established. The profile uses confirmed client, parent, and controller indicators and excludes commercial customer gateways because contacting a gateway does not prove SDK presence.
Synthient's Research Team has not assigned a HIGH, MEDIUM, or LOW risk score to APsolo because no randomized sample of consent practices was completed. The supplied analysis establishes the client relationship but does not provide a verified end-user disclosure or revocation flow for its parent application.
Research record
| Field | Finding |
|---|---|
| Operator / jurisdiction | Unlimited Connection Technology Co., Limited · Hong Kong |
| Operating history | Provider states service began in 2019 |
| Network type | Residential, mobile, ISP, datacenter, and Android proxyware-sourced network |
| Verified channels | No named downstream reseller verified; shared gateways are not treated as reseller proof |
| SDK / platforms | APsolo / Solo-Ximple (ipwb) · Android · monetization mechanism not publicly established |
| Consent / KYC | No consent-risk grade or randomized sample claimed; parent-app disclosure, revocation, and buyer KYC were not verified |
| Infrastructure | APsolo Android parent and controller indicators are observed; related domains, certificates, hashes, and IPs appear below |
| Review dates | Research updated 2026-09-28 · use the live lookup for current last-seen network observations |
- Field
- Operator / jurisdiction
- Finding
- Unlimited Connection Technology Co., Limited · Hong Kong
- Field
- Operating history
- Finding
- Provider states service began in 2019
- Field
- Network type
- Finding
- Residential, mobile, ISP, datacenter, and Android proxyware-sourced network
- Field
- Verified channels
- Finding
- No named downstream reseller verified; shared gateways are not treated as reseller proof
- Field
- SDK / platforms
- Finding
- APsolo / Solo-Ximple (
ipwb) · Android · monetization mechanism not publicly established
- Field
- Consent / KYC
- Finding
- No consent-risk grade or randomized sample claimed; parent-app disclosure, revocation, and buyer KYC were not verified
- Field
- Infrastructure
- Finding
- APsolo Android parent and controller indicators are observed; related domains, certificates, hashes, and IPs appear below
- Field
- Review dates
- Finding
- Research updated 2026-09-28 · use the live lookup for current last-seen network observations
Reseller Graph
The highlighted node is the provider named on this card. Reseller arrows point toward that provider. App, SDK, and supply associations are labeled separately and do not establish ownership.
Yara Rules
rule Proxyware_APsolo_Android_SoloClientDex
{
meta:
description = "IPWeb Solo/Ximple UDP registration and relay client"
provider = "IPWeb"
sdk = "APsolo"
category = "proxyware"
author = "Synthient"
confidence = "high"
strings:
$controller = "34.237.159.252:11116" ascii fullword
$main = "Lcom/example/appprocess/AppProcessMain;" ascii
$connected = "ConnectedToProxserver" ascii fullword
$proxy_error = "Post chkkey to proxy error: " ascii
$server = "ServerInfo:Address=" ascii
$start = "PrxThreadStart" ascii fullword
condition:
uint32(0) == 0x0a786564 and
filesize > 40KB and filesize < 50KB and
all of them
}This rule identifies an SDK family. A match alone does not establish malicious activity or the absence of consent.
Indicators of Compromise
File Hashes
| Type | Indicator | Context |
|---|---|---|
| SHA-256 | 294319b32d8af7ba73a8e87312c50f1c87e300f5a724574a35bbaaf29485153e | Recovered ipwb client JAR |
| SHA-256 | fdff2ba666a2e7e1f2a40c47fd6051fa278dfceb16eef75a64ee7c2146eada47 | Client DEX extracted from the recovered JAR |
| SHA-256 | 1069cae558acc0dbb7b1df930b6f280d877697562945e42669bf130bc0abb4ff | Android parent carrying the client |
- Type
- SHA-256
- Context
- Recovered
ipwbclient JAR
- Type
- SHA-256
- Context
- Client DEX extracted from the recovered JAR
- Type
- SHA-256
- Context
- Android parent carrying the client
Domains
No confirmed domains are included in the reviewed source corpus.
IP Addresses
| Type | Indicator | Context |
|---|---|---|
| IP address | 34[.]237[.]159[.]252:11116 | Tier 1; APsolo |
- Type
- IP address
- Indicator
- Context
- Tier 1; APsolo
Research updated September 28, 2026. Last-seen observations change continuously; verify an address with the live lookup before acting.
Additional IOCs are hidden.
Available to subscribers. This preview shows up to ten IP addresses, ten domains, and ten file hashes.
7-day activity
Illustrative preview
See the activity behind the provider.
Unlock daily events and unique IP trends to understand how this provider’s network changes over time.