MASSIVE

MASSIVE is a United States company operated by Massive Computing Inc. which has been in operation since 2018. They are known for residential and ISP proxies, web-access APIs, and application monetization; their provider-size classification remains unassessed. Synthient's Research Team did not verify a named downstream reseller in the reviewed SDK corpus. The official domain is joinmassive.com. Operating history · Products.

MASSIVE is observed leveraging MassiveSDK to obtain IP addresses, with the SDK distributed across Android, Windows, Node.js/webOS, and vendor-documented macOS. The MassiveSDK is classified as App Monetization and can be observed in integrations associated with Adblock Fast, Purple IPTV hosts, and the Massive host dashboard. These are observed host families rather than a complete inventory of current partner applications.

Synthient's Research Team has not assigned a HIGH, MEDIUM, or LOW risk score to the reviewed MassiveSDK corpus because no randomized sample of consent practices was completed. MASSIVE states that participation is opt-in and users exchange spare resources for app features, but those published controls do not independently verify consent in each host build. Vendor participation policy.

Reseller Graph

The highlighted node is the provider named on this card. Reseller arrows point toward that provider. App, SDK, and supply associations are labeled separately and do not establish ownership.

Yara Rules

rule Proxyware_MassiveSDK_Android_WsTunnel
{
    meta:
        description = "Massive/JoinMassive Android websocket TCP pivot SDK, original and relocated namespaces"
        provider    = "JoinMassive"
        sdk         = "MassiveSDK"
        platform    = "Android DEX/APK"
        variant     = "ws-tunnel"
        category    = "proxyware"
        author      = "Synthient"
        date        = "2026-08-27"
        confidence  = "high"
        intel_family = "massive-joinmassive"
    strings:
        $api    = "https://api.joinmassive.com" ascii
        $anon   = "X-Massive-Anon-Id" ascii
        $config = "/sdk/config?uid=" ascii
        $origin = "massivesdk-android://" ascii
        $tunnel = "WsHTTPSTunnel" ascii
        $proxy  = "Lcom/massive/sdk/proxy/ProxyClient;" ascii

        /* The SDK ships relocated for white-label hosts; the namespace moves,
           the control-plane contract above does not. */
        $ns_join      = "Lcom/joinmassive/sdk/" ascii
        $ns_massive   = "Lcom/massive/sdk/" ascii
        $ns_analytics = "Lms/analytics/sdk/" ascii
        $ns_isav      = "Lio/isav/sdk/" ascii
        $ns_finsky    = "Lorg/finsky/sdk/" ascii
        $ns_instabug  = "Lco/instabug/sdk/" ascii
        $ns_flutter   = "Lid/flutter/sdk/" ascii
        $ns_work      = "Landroidx/work/lib/sdk/" ascii
    condition:
        (uint32(0) == 0x0a786564 or uint32(0) == 0x04034b50) and
        filesize < 200MB and
        $anon and
        2 of ($config, $origin, $tunnel, $proxy, $api) and
        1 of ($ns_*)
}

This rule identifies an SDK family. A match alone does not establish malicious activity or the absence of consent.

Indicators of Compromise

File Hashes

Domains

IP Addresses