NIMBLE

Nimbleway, also known as Nimble, is a United States-based company with Israeli origins which has been in operation since 2021. They are known for residential proxies, web-data APIs, and scraping infrastructure and are provisionally considered a medium sized proxy provider based on their advertised pool of more than one million residential IPs. Synthient's Research Team did not verify a named downstream reseller; SDK supply relationships are not treated as reseller or ownership evidence. Company background · Published network scale.

Nimbleway is observed leveraging AppgainProxit (Appgain / Digital Pulse) and Quantum to obtain IP addresses, with the SDKs distributed across Android and Windows and additional desktop variants documented for Quantum. These SDKs are classified as App Monetization and can be observed in Flix Vision 3.0.1r and Digital Pulse service builds. This is an observed sample relationship, not a claim about every current Nimbleway integration.

Synthient's Research Team assigns a provisional HIGH risk score to the reviewed AppgainProxit integration based on a targeted static and VirusTotal sample, not a randomized survey. In Flix Vision 3.0.1r, application startup schedules recurring Appgain work with a default-enabled setting; the worker starts the SDK following a remote activation response without a local affirmative-consent check in that path. This does not establish the consent behavior of all AppgainProxit or Quantum hosts.

Reseller Graph

The highlighted node is the provider named on this card. Reseller arrows point toward that provider. App, SDK, and supply associations are labeled separately and do not establish ownership.

Yara Rules

rule Proxyware_AppgainProxit_Android_GoCore
{
    meta:
        description = "Appgain Android Go gRPC controller and Proxit TCP manager relay core"
        provider    = "Nimbleway"
        sdk         = "AppgainProxit"
        platform    = "Android native ELF (ARMv7, ARM64, x86, x86-64)"
        variant     = "appgain-go-core"
        aliases     = "Appgain, Proxit"
        category    = "proxyware"
        author      = "Synthient"
        date        = "2026-08-31"
        confidence  = "high"
        observed_version = "0.17.15"
        intel_family = "appgain-proxit"
    strings:
        $source = "/home/charles/Documents/code/proxit/src/proxit.com/peers/client" ascii
        $manager = "client.com/appgain.(*sClient).getProxyManagerConnection" ascii
        $jni = "Java_appgain_Appgain_run" ascii
        $run = "proxyappgain__Run" ascii
        $controller = "bapp.netlink-connect.com" ascii
        $rpc = "/serverModel.Server/Init" ascii
    condition:
        uint32(0) == 0x464c457f and
        filesize > 5MB and filesize < 30MB and
        5 of them
}

This rule identifies an SDK family. A match alone does not establish malicious activity or the absence of consent.

Indicators of Compromise

File Hashes

Domains

IP Addresses