IPROYAL

IPRoyal is a Lithuanian-founded company, with current official materials listing the United Arab Emirates, which has been in operation since 2020. They are known for residential, ISP, datacenter, and mobile proxies with low-commitment plans and broad integrations and are considered a medium sized proxy provider. Synthient's Research Team has found proxy resellers such as BeyondProxy, LightningProxies, and ProxyStore to be providing access to IPRoyal. These indirect sales channels highlight a potential risk due to limited downstream regulation or KYC controls.

IPRoyal is observed leveraging Pawns to obtain large swaths of IP addresses. Pawns is distributed across Android, iOS, Windows, macOS, and Linux, is classified as Pay-Bandwidth and App Monetization, and has been observed in Pawns.app, Football Fixtures Pro, and AniVortex.

Synthient's Research Team assigns a MEDIUM risk score to Pawns based on a randomized sample of consent practices observed in the wild.

Provider relationships

Yara Rules

rule Proxyware_Pawns_MultiPlatform_GoEngine
{
    meta:
        description = "Pawns Go exit-node engine: SSH reverse tunnel plus residential-API websocket control"
        provider    = "IProyal"
        sdk         = "Pawns"
        platform    = "Android/Linux ELF, Windows PE/DLL, iOS/macOS Mach-O"
        variant     = "go-engine"
        category    = "proxyware"
        author      = "Synthient"
        date        = "2026-08-27"
        confidence  = "high"
        intel_family = "pawns"
    strings:
        $mole   = "mole/ssh_reverse_proxy.go" ascii
        $resi   = "residentialapi/websocket_client.go" ascii
        $mgr    = "proxymanager/proxy_manager.go" ascii
        $module = "go-pawns/v2" ascii

        $api    = "resi-api.pawns.app" ascii
        $api6   = "resi6-api.pawns.app" ascii
        $iproyal = "api.iproyal.com" ascii
        $carrier = "RunstimeHost" ascii
    condition:
        (uint32(0) == 0x464c457f or uint16(0) == 0x5a4d or
         uint32(0) == 0xfeedfacf or uint32(0) == 0xcffaedfe or
         uint32(0) == 0x04034b50) and
        filesize > 256KB and filesize < 250MB and
        2 of ($mole, $resi, $mgr, $module) and
        1 of ($api, $api6, $iproyal) and not $carrier
}

This rule identifies an SDK family. A match alone does not establish malicious activity or the absence of consent.

Indicators of Compromise

File Hashes

Domains

IP Addresses