KOOKEEY

Kookeey is a Hong Kong company which has been in operation since 2018. They are known for residential, ISP, and datacenter proxies and are provisionally considered a medium sized proxy provider based on their advertised 47-million residential IP pool. Synthient's Research Team did not verify a named downstream reseller in the reviewed corpus. Reseller regulation or KYC controls cannot be inferred from network size. Company background and published scale.

Kookeey is observed leveraging the Robin SDK to obtain IP addresses, with the SDK distributed across Android. The Robin SDK is classified as App Monetization / proxyware and can be observed in SalesStat and SpeedAdv carrier builds, with both Java and protected native variants. Nearby update and telemetry infrastructure is excluded because it does not establish a proxyware relationship.

Synthient's Research Team has not assigned a HIGH, MEDIUM, or LOW risk score to the reviewed Robin SDK corpus because no randomized sample of consent prompts or opt-out controls was completed. SDK identification and carrier presence establish an integration to investigate, not a consent finding.

Research record

Reseller Graph

The highlighted node is the provider named on this card. Reseller arrows point toward that provider. App, SDK, and supply associations are labeled separately and do not establish ownership.

Yara Rules

rule Proxyware_Robin_Android_AdProxyCore
{
    meta:
        description = "Kookeey Robin Android relay SDK under the obfuscated com.ad.proxy namespace"
        provider    = "Kookeey"
        sdk         = "Robin"
        platform    = "Android DEX"
        variant     = "ad-proxy"
        category    = "proxyware"
        author      = "Synthient"
        date        = "2026-08-27"
        confidence  = "high"
        intel_family = "robin"
    strings:
        $root_dotted = "com.ad.proxy.Robin" ascii
        $root        = "Lcom/ad/proxy/Robin;" ascii
        $listener    = "Lcom/ad/proxy/StatusListener;" ascii
        $status      = "Lcom/ad/proxy/Status;" ascii
        $start       = "startFromAndroid" ascii

        /* Single-letter obfuscated subpackages. Individually meaningless; as a
           set they are the shape of this SDK's ProGuard output. */
        $obf_a = "Lcom/ad/proxy/a/A;" ascii
        $obf_b = "Lcom/ad/proxy/b/A;" ascii
        $obf_c = "Lcom/ad/proxy/c/A;" ascii
        $obf_d = "Lcom/ad/proxy/d/A;" ascii
        $obf_e = "Lcom/ad/proxy/e/A;" ascii
        $obf_f = "Lcom/ad/proxy/f/A;" ascii

        $api = "api.kookjar.com" ascii
    condition:
        uint32(0) == 0x0a786564 and
        filesize < 60MB and
        1 of ($root, $root_dotted) and
        (($listener and 1 of ($status, $start)) or 4 of ($obf_*) or $api)
}

This rule identifies an SDK family. A match alone does not establish malicious activity or the absence of consent.

Indicators of Compromise

File Hashes

Domains

IP Addresses