MASKIFY

Maskify is a Russia-oriented company which has been in operation since 2025. They are known for no-KYC access-token accounts, cryptocurrency payments, SOCKS/HTTP/UDP residential proxies, and reseller and white-label services and are considered a medium sized proxy provider. Synthient's Research Team has found proxy resellers such as BudgetProxy, VaultProxies, qProxy, and SousMarket to be providing access to Maskify. These indirect sales channels and the absence of customer KYC create a significant abuse and accountability risk.

Maskify is observed leveraging Earnify to source IP addresses, with the SDK distributed across Android. The Earnify SDK is classified as Malware and can be observed in Ambient Display Core and Android system-service packages. Recovered variants include system-component masquerading, boot persistence, IPFS-delivered updates, multi-hop residential proxying, remote shell execution, and TCP, UDP, TLS, SSH, and HTTP traffic-flooding handlers.

Synthient's Research Team assigns a HIGH risk score to Earnify based on a randomized sample of consent practices observed in the wild. The sampled packages did not present a clear user-facing bandwidth-sharing or reward flow and instead used Android system-service names, watchdogs, boot receivers, dynamic native payload replacement, and campaign-gated enrollment.

Research record

Reseller Graph

The highlighted node is the provider named on this card. Reseller arrows point toward that provider. App, SDK, and supply associations are labeled separately and do not establish ownership.

Yara Rules

rule Proxyware_Earnify_Android_NativeSDK
{
    meta:
        description = "Earnify/Maskify Android Rust/QUIC proxy SDK"
        provider    = "Maskify"
        sdk         = "Earnify"
        category    = "proxyware"
        author      = "Synthient"
        date        = "2026-08-31"
        confidence  = "high"
        platform    = "android"
        variant     = "native-sdk"
        intel_family = "earnify"
    strings:
        $jni_1 = "Java_io_earnify_sdk_EarnifySDK_nativeInit" ascii fullword
        $jni_2 = "Java_io_earnify_sdk_EarnifySDK_nativeStart" ascii fullword
        $jni_3 = "Java_io_earnify_sdk_EarnifySDK_nativeGetBytesProxied" ascii fullword
        $abi_1 = "earnify_sdk_init" ascii fullword
        $abi_2 = "earnify_sdk_start" ascii fullword
        $abi_3 = "earnify_sdk_stats" ascii fullword
        $abi_4 = "earnify_sdk_set_consent" ascii fullword
        $session_1 = "expected control stream from server" ascii
        $session_2 = "expected ConnectToServer" ascii
        $session_3 = "relayserver did not assign client_id" ascii
        $session_4 = "session auth rejected" ascii
        $mesh_1 = "peer exchange: truncated node_id" ascii
        $mesh_2 = "no resolver set for this ENS name" ascii
        $mesh_3 = "IPFS seed resolution not yet implemented" ascii
        $mesh_4 = "Za Rodinu mesh config found" ascii
        $relay_1 = "earnify-core/src/tunnel.rs" ascii
        $relay_2 = "TCP connected, relaying" ascii
        $relay_3 = "UDP connected, relaying" ascii
        $relay_4 = "received ConnectToServer signal" ascii
    condition:
        uint32(0) == 0x464c457f and filesize > 1MB and filesize < 5MB and
        2 of ($jni_*) and 3 of ($abi_*) and 2 of ($session_*) and
        (2 of ($mesh_*) or all of ($relay_*))
}

This rule identifies an SDK family. A match alone does not establish malicious activity or the absence of consent.

Indicators of Compromise

File Hashes

Domains

IP Addresses