RAYOBYTE

Rayobyte is a United States company which has been in operation since 2015 under its former Blazing SEO name and since 2022 as Rayobyte. They are known for US datacenter proxies, residential and ISP proxies, scraping infrastructure, and reseller tooling and are considered a medium sized proxy provider. Synthient's Research Team has found ProxyReseller.com to be providing access to Rayobyte infrastructure. This white-label access highlights a potential risk due to limited downstream regulation or KYC controls.

Rayobyte is observed leveraging CashRaven to obtain large swaths of IP addresses. CashRaven is distributed across Android, Android TV/Fire TV, Windows, macOS, Linux, and Electron/Node.js, is classified as App Monetization, and has been observed in RapidStreamz, CRUnblockPuzzle, and BlinkStreamz.

Synthient's Research Team assigns a MEDIUM risk score to CashRaven based on a randomized sample of consent practices observed in the wild.

Research record

Reseller Graph

The highlighted node is the provider named on this card. Reseller arrows point toward that provider. App, SDK, and supply associations are labeled separately and do not establish ownership.

Yara Rules

rule Proxyware_Cashraven_Android_LegacyJavaSdk
{
    meta:
        description = "CashRaven/Rayobyte legacy Java Android SDK with foreground relay service"
        provider    = "Rayobyte"
        sdk         = "Cashraven"
        platform    = "Android DEX/APK"
        variant     = "legacy-java"
        category    = "proxyware"
        author      = "Synthient"
        date        = "2026-08-27"
        confidence  = "high"
        intel_family = "cashraven-rayobyte"
    strings:
        $namespace   = "Lio/cashraven/sdk/ForegroundService;" ascii
        $rayobyte    = "Lio/cashraven/sdk/Rayobyte;" ascii
        $residential = "residential.rayobyte.com" ascii
        $balancer    = "lb.cashraven.io" ascii
        $config      = "config.cashraven.io/v1/config" ascii
        $agreement   = "proxy_preferences_agreement_status" ascii
        $c2w         = "ProxyTunnelC2W" ascii
        $w2c         = "ProxyTunnelW2C" ascii
    condition:
        (uint32(0) == 0x0a786564 or uint32(0) == 0x04034b50) and
        filesize < 200MB and
        1 of ($namespace, $rayobyte) and
        3 of ($residential, $balancer, $config, $agreement, $c2w, $w2c)
}

This rule identifies an SDK family. A match alone does not establish malicious activity or the absence of consent.

Indicators of Compromise

File Hashes

Domains

IP Addresses