SOAX

SOAX is a United Kingdom company incorporated in 2019 which has been in operation since 2020. They are known for residential and mobile proxies, scraper APIs, web unblocking, and granular geo-targeting and are considered a medium sized proxy provider. Synthient's Research Team has found Froxy to be providing access to SOAX. This indirect sales channel highlights a potential risk due to limited downstream regulation or KYC controls.

SOAX is observed leveraging SoftZero to source IP addresses. SoftZero is distributed across Android, is classified as App Monetization, and has been observed in Ocean Streamz, Red Stream, and Ares MP3.

Synthient's Research Team assigns a MEDIUM risk score to SoftZero based on a randomized sample of consent practices observed in the wild.

Research record

Reseller Graph

The highlighted node is the provider named on this card. Reseller arrows point toward that provider. App, SDK, and supply associations are labeled separately and do not establish ownership.

Yara Rules

rule Proxyware_SoftZero_Android_RelocatedZ5
{
    meta:
        description = "SOAX SoftZero Android relay generation using the softzero and z5 package split"
        provider    = "Soax"
        sdk         = "SoftZero"
        platform    = "Android DEX/APK"
        variant     = "softzero-z5"
        category    = "proxyware"
        author      = "Synthient"
        date        = "2026-08-27"
        confidence  = "high"
        intel_family = "soax"
    strings:
        $softzero_b = "Lsoftzero/b;" ascii
        $softzero_c = "Lsoftzero/c;" ascii
        $engine     = "Lz5/f;" ascii

        /* Obfuscated method-name blobs the engine decrypts at runtime; they are
           byte-stable across builds and carry no plaintext to generalise on. */
        $enc_connect    = { 24 73 5F 72 48 1D 79 23 48 6B 4E 4E 1D 64 32 74 40 }
        $enc_initialize = { 24 73 5F 72 7E 1A 64 3E 63 5D 4C 4D 1A 70 32 }
        $enc_logging    = { 24 78 55 55 1B 1F 65 30 70 5D 43 46 2C 68 25 78 55 49 42 12 79 23 48 46 48 46 2C 63 33 }
        $enc_construct  = { 24 73 5F 72 48 1D 79 23 48 6B 4E 4E 1D 79 23 65 41 4E 55 }
    condition:
        (uint32(0) == 0x0a786564 or uint32(0) == 0x04034b50) and
        filesize < 60MB and
        2 of ($softzero_*) and $engine and 3 of ($enc_*)
}

This rule identifies an SDK family. A match alone does not establish malicious activity or the absence of consent.

Indicators of Compromise

File Hashes

Domains

IP Addresses

No confirmed ip addresses are included in the reviewed source corpus.