Synthient
Get in touch

IPIDEA

providerrecent activityhigh riskResidential Proxy

proxy context, 255.6M events over 7 days

IPIDEA operates the largest known residential proxy network. In January 2026, Google disrupted IPIDEA's operations through legal proceedings, domain takedowns, and enforcement actions targeting software development kits (SDKs).

IPIDEA acquires devices through multiple SDKs embedded in consumer applications, such as CastarSDK, EarnSDK, HexSDK, and PacketSDK. The network uses a two-tier command-and-control architecture: Tier 1 domains facilitate device enrollment, with Tier 2 IP-based servers coordinating proxy tasking globally.

IPIDEA manages several proxy brands that serve as front services, including 360 Proxy, 922 Proxy, ABC Proxy, Cherry Proxy, IP2World, Luna Proxy, PIA S5 Proxy, and PyProxy.

IPIDEA's infrastructure has been associated with the BadBox2.0, Aisuru, and Kimwolf botnets. According to Synthient's research, Android devices within IPIDEA's pool were frequently unauthenticated, rendering them susceptible to remote code execution. The Kimwolf botnet exploited this vulnerability to compromise devices via DNS rebinding across IPIDEA's network. IPIDEA addressed the vulnerability on December 28, 2025, following Synthient's notification.

Observables
Network Observables
DomainDescription
packetsdk.xyzPacketSDK enrollment
packetsdk.netPacketSDK enrollment
packetsdk.ioPacketSDK enrollment
hexsdk.comHexSDK enrollment
castarsdk.comCastarSDK enrollment
earnsdk.ioEarnSDK enrollment
lhvaax5tln2p6rgp.comTier 1 C2
hu6xh24bkhs9l6dm.comTier 1 C2
IP Observables
IP AddressASNProviderDescription
43.102.2.0AS45102Alibaba Cloud (Singapore) Private LimitedIPIDEA Relay Server
43.102.2.1AS45102Alibaba Cloud (Singapore) Private LimitedIPIDEA Relay Server
43.102.2.2AS45102Alibaba Cloud (Singapore) Private LimitedIPIDEA Relay Server
43.102.2.3AS45102Alibaba Cloud (Singapore) Private LimitedIPIDEA Relay Server
43.102.2.4AS45102Alibaba Cloud (Singapore) Private LimitedIPIDEA Relay Server
43.102.2.7AS45102Alibaba Cloud (Singapore) Private LimitedIPIDEA Relay Server
43.102.2.11AS45102Alibaba Cloud (Singapore) Private LimitedIPIDEA Relay Server
43.102.2.12AS45102Alibaba Cloud (Singapore) Private LimitedIPIDEA Relay Server
File Observables
SHA-256FilenameDescription
aef34f14456358db91840c416e55acc7d10185ff2beb362ea24697d7cdad321fPacketSDK.dllPacketSDK Windows DLL
b0726bdd53083968870d0b147b72dad422d6d04f27cd52a7891d038ee83aef5bPacketSDK.apkPacketSDK Android APK
2d1891b6d0c158ad7280f0f30f3c9d913960a793c6abcda249f9c76e13014e45HexSDK.apkHexSDK Android APK
9479da1c597ffa05d262b6fcb2717ef775876ac14dc163a30f1e372b81a31c76PowerVPN (Premium)\_2.4 by ANiK555_enc.apkPowerVPN trojanized app
59cbdecfc01eba859d12fbeb48f96fe3fe841ac1aafa6bd38eff92f0dcfd4554RadishVPN.apkRadishVPN trojanized app
Events 24h
48.9M
active window
Events 7d
255.6M
observed
Unique IPs
16.5M
pool sightings
Countries
231
top IN
Categories
1
Residential Proxy
Top ASN
AS55836
last 7d

Provider totals cover the recent seven-day window, checked 2026-07-25 03:33 UTC.

Activity

Provider pool activity

events and unique IPs over time, UTC last 7 days

EventsUnique IPs
Geography

Top countries

unique IPs by country

India2.47M IPs
Brazil2.35M IPs
SA1.03M IPs
BD103K IPs
PK513K IPs
TR455K IPs
Category

Traffic mix

provider classifications

Residential Proxy255.6M