OXYLABS

Oxylabs is a Lithuanian company which has been in operation since 2015. They are known for enterprise residential, mobile, and ISP proxies, scraper APIs, datasets, and large-scale web intelligence and are considered a large sized proxy provider. Oxylabs is part of the Tesonet portfolio, alongside Decodo. Synthient's Research Team has found proxy resellers such as TorchProxies, WiredProxies, and ShieldProxies to be providing access to Oxylabs. These indirect sales channels highlight a potential risk due to limited downstream regulation or KYC controls.

Oxylabs is observed leveraging Honeygain to source IP addresses. Honeygain is distributed across Android, iOS, Windows, macOS, and Linux, is classified as Pay-Bandwidth and App Monetization, and has been observed in Cinema HQ, DooFlix, and RapidStreams.

Synthient's Research Team assigns a MEDIUM risk score to Honeygain based on a randomized sample of consent practices observed in the wild.

Provider relationships

Yara Rules

rule Proxyware_Honeygain_Android_VoblerEngine
{
    meta:
        description = "Honeygain vobler/hgsdk Android QUIC exit-node engine"
        provider    = "Oxylabs"
        sdk         = "Honeygain"
        platform    = "Android DEX/APK"
        variant     = "vobler-hgsdk"
        category    = "proxyware"
        author      = "Synthient"
        date        = "2026-08-27"
        confidence  = "high"
        intel_family = "honeygain"
    strings:
        /* Kotlin data-class toString() prefix for the registration payload;
           only removable by dropping the data-class modifier. */
        $specs = "StaticSpecs(cid=" ascii

        $sdk_class = "Lcom/honeygain/hgsdk/HgSdk;" ascii
        $quic_pkg  = "com/honeygain/vobler/lib/sdk/quic" ascii
        $consent   = "Lcom/honeygain/hgsdk/ui/ConsentUiActivity;" ascii

        /* Protobuf enum value names shared with the server .proto: renaming
           them is a wire-compatibility break, so R8 leaves them intact. */
        $enum_connect = "FAILED_CONNECT_TO_TARGET" ascii
        $enum_resolve = "UNABLE_TO_RESOLVE_HOSTNAME" ascii
        $enum_limit   = "REQUEST_LIMIT_REACHED" ascii

        $prefs   = "fg-storage" ascii
        $consent_key = "didConsent" ascii
        $cid     = /HSDK(AN|AMZ|IOS)[A-Z0-9]{2,18}[0-9]{6}[A-Z0-9]{0,6}/ ascii
        $appsalt_class = "Lcom/appsalt/Appsalt;" ascii
        $appsalt_cid = "HASDKAN" ascii
        $appsalt_control = "connect.sdk.absolut.fit/ws/v2" ascii
    condition:
        (uint32(0) == 0x0a786564 or uint32(0) == 0x04034b50) and
        filesize < 300MB and
        1 of ($specs, $sdk_class, $quic_pkg) and
        2 of ($consent, $enum_connect, $enum_resolve, $enum_limit, $prefs, $consent_key, $cid) and
        none of ($appsalt_*)
}

This rule identifies an SDK family. A match alone does not establish malicious activity or the absence of consent.

Indicators of Compromise

File Hashes

Domains

IP Addresses