PROXYRACK

ProxyRack is a Hong Kong company operated by Secure Privacy Group Limited which has been in operation since 2014. They are known for residential, datacenter, and mobile proxies and are provisionally considered a medium sized proxy provider based on their advertised 35-million residential IP pool. Synthient's Research Team did not verify a named downstream reseller. The provider's own KYC claims do not establish the regulation or KYC controls of a separate sales channel. Company timeline · Operator · Product coverage.

ProxyRack is observed leveraging ProxyRackSDK to obtain IP addresses, with the SDK distributed across Android and Windows. The ProxyRackSDK is classified as Pay-Bandwidth / App Monetization and can be observed in the Android Proxy Control app and Windows cores submitted under Point of Presence and EasyAsVPN. The Windows names come from submitted paths and signatures and do not independently prove a consent failure.

Synthient's Research Team assigns a provisional MEDIUM risk score to the reviewed ProxyRackSDK corpus based on a targeted sample of consent practices, not a randomized survey. Static review of Proxy Control found a default-disabled sharing state, a persistent user toggle, and a bandwidth-sharing explanation. Equivalent disclosure and consent could not be verified for the legacy Windows hosts.

Research record

Reseller Graph

The highlighted node is the provider named on this card. Reseller arrows point toward that provider. App, SDK, and supply associations are labeled separately and do not establish ownership.

Yara Rules

rule Proxyware_ProxyRackSDK_Android_GoClientCore
{
    meta:
        description = "Proxyrack go_client reverse-proxy core with NUL-framed JSON control and SOCKS5 multiplexing"
        provider    = "ProxyRack"
        sdk         = "ProxyRackSDK"
        platform    = "Android ELF"
        variant     = "go-client"
        category    = "proxyware"
        author      = "Synthient"
        date        = "2026-08-28"
        confidence  = "high"
        intel_family = "proxyrack"
    strings:
        $module   = "bitbucket.org/proxyrackteam/go_client" ascii
        $reverse  = "{\"type\":\"reverseCon\",\"msg\":{\"id\":\"%s\"}}" ascii
        $realconn = "go_client/pkg/rvrsproxy/realconn" ascii
        $udp      = "go_client/pkg/rvrsproxy/udpproxy" ascii
        $conn     = "go_client/pkg/rvrsproxy/connhandler" ascii
        $msg      = "go_client/pkg/messenger/message" ascii
    condition:
        uint32(0) == 0x464c457f and
        filesize > 256KB and filesize < 60MB and
        $module and
        3 of ($reverse, $realconn, $udp, $conn, $msg)
}

This rule identifies an SDK family. A match alone does not establish malicious activity or the absence of consent.

Indicators of Compromise

File Hashes

Domains

IP Addresses

No confirmed ip addresses are included in the reviewed source corpus.