IPIDEA

IPIDEA is a Chinese company operating since 2019, known for residential proxy pools, bulk access, and affiliated proxy/VPN brands. It is considered large sized. Synthient has identified ABCProxy, Galleon VPN, and PIA S5 Proxy as downstream brands accessing its infrastructure. These indirect channels complicate KYC. October 2026 research identifies IPIDEA as a reseller of IPWeb after the January disruption.

IPIDEA is observed leveraging PacketSDK across Android, Windows, and Linux. PacketSDK is App Monetization / high-risk proxyware, observed in SuperFree VPN, DUKTEK TV Premium, and SmartTeach. The Kimwolf investigation documented exposed-device access through IPIDEA; IPIDEA patched local-network and sensitive-port access on December 28, 2025. The report explicitly separates IPIDEA from the Kimwolf operators.

Synthient's Research Team assigns a HIGH risk score to PacketSDK based on a randomized sample of consent practices observed in the wild.

Provider relationships

Google Threat Intelligence Group identified the shared operators behind the brands below and four supplying SDK families in January 2026. The shared-operator links supersede their earlier reseller classification.

Yara Rules

rule Proxyware_PacketSDK_Android_RendezvousRelay
{
    meta:
        description = "PacketSDK Android TCP/QUIC rendezvous implementation"
        provider = "IPIDEA"
        sdk = "PacketSDK"
        platform = "Android DEX/APK/ELF"
        variant = "rendezvous-relay"
        category = "proxyware"
        author = "Synthient"
        date = "2026-08-28"
        confidence = "high"
        intel_family = "packet-sdk"
    strings:
        $sdk = "Lcom/packet/sdk/PacketSdk;" ascii
        $seed = "c2VlZC5wYWNrZXRzZGsueHl6LXNlZWQucGFja2V0c2RrLm5ldC1zZWVkLnBhY2tldHNkay5pbw==" ascii
        $legacy = "12345678900987654321" ascii
        $dispatch = "http:/dispatch-api.%s/dp/getServer" ascii
        $bootstrap = "/dp/getServer" ascii
        $prefs = "packet_sdk.xml" ascii
        $api_seed = "api-seed.packetsdk.io" ascii
        $v103 = "v1.0.3" ascii fullword
    condition:
        (uint32(0) == 0x0a786564 or uint32(0) == 0x04034b50 or
         uint32(0) == 0x464c457f) and
        filesize < 200MB and
        (($sdk and 2 of ($seed, $legacy, $dispatch, $bootstrap, $prefs, $api_seed)) or
         ($seed and 2 of ($legacy, $dispatch, $bootstrap, $prefs, $api_seed)) or
         ($seed and $legacy and $v103))
}

This rule identifies an SDK family. A match alone does not establish malicious activity or the absence of consent.

Indicators of Compromise

File Hashes

Domains

IP Addresses