IPIDEA
Providerrecent activityhigh riskResidential Proxyproxy context, 298.4M events over 7 days
- Website
ipidea[.]io- Gateway
43[.]159[.]20[.]153:2333
IPIDEA operates the largest known residential proxy network. In January 2026, Google disrupted IPIDEA's operations through legal proceedings, domain takedowns, and enforcement actions targeting software development kits (SDKs).
IPIDEA acquires devices through multiple SDKs embedded in consumer applications, such as CastarSDK, EarnSDK, HexSDK, and PacketSDK. The network uses a two-tier command-and-control architecture: Tier 1 domains facilitate device enrollment, with Tier 2 IP-based servers coordinating proxy tasking globally.
IPIDEA manages several proxy brands that serve as front services, including 360 Proxy, 922 Proxy, ABC Proxy, Cherry Proxy, IP2World, Luna Proxy, PIA S5 Proxy, and PyProxy.
IPIDEA's infrastructure has been associated with the BadBox2.0, Aisuru, and Kimwolf botnets. According to Synthient's research, Android devices within IPIDEA's pool were frequently unauthenticated, rendering them susceptible to remote code execution. The Kimwolf botnet exploited this vulnerability to compromise devices via DNS rebinding across IPIDEA's network. IPIDEA addressed the vulnerability on December 28, 2025, following Synthient's notification.
Observables
Network Observables
| Domain | Description |
|---|---|
| packetsdk.xyz | PacketSDK enrollment |
| packetsdk.net | PacketSDK enrollment |
| packetsdk.io | PacketSDK enrollment |
| hexsdk.com | HexSDK enrollment |
| castarsdk.com | CastarSDK enrollment |
| earnsdk.io | EarnSDK enrollment |
| lhvaax5tln2p6rgp.com | Tier 1 C2 |
| hu6xh24bkhs9l6dm.com | Tier 1 C2 |
- Domain
- packetsdk.xyz
- Description
- PacketSDK enrollment
- Domain
- packetsdk.net
- Description
- PacketSDK enrollment
- Domain
- packetsdk.io
- Description
- PacketSDK enrollment
- Domain
- hexsdk.com
- Description
- HexSDK enrollment
- Domain
- castarsdk.com
- Description
- CastarSDK enrollment
- Domain
- earnsdk.io
- Description
- EarnSDK enrollment
- Domain
- lhvaax5tln2p6rgp.com
- Description
- Tier 1 C2
- Domain
- hu6xh24bkhs9l6dm.com
- Description
- Tier 1 C2
IP Observables
| IP Address | ASN | Provider | Description |
|---|---|---|---|
| 43.102.2.0 | AS45102 | Alibaba Cloud (Singapore) Private Limited | IPIDEA Relay Server |
| 43.102.2.1 | AS45102 | Alibaba Cloud (Singapore) Private Limited | IPIDEA Relay Server |
| 43.102.2.2 | AS45102 | Alibaba Cloud (Singapore) Private Limited | IPIDEA Relay Server |
| 43.102.2.3 | AS45102 | Alibaba Cloud (Singapore) Private Limited | IPIDEA Relay Server |
| 43.102.2.4 | AS45102 | Alibaba Cloud (Singapore) Private Limited | IPIDEA Relay Server |
| 43.102.2.7 | AS45102 | Alibaba Cloud (Singapore) Private Limited | IPIDEA Relay Server |
| 43.102.2.11 | AS45102 | Alibaba Cloud (Singapore) Private Limited | IPIDEA Relay Server |
| 43.102.2.12 | AS45102 | Alibaba Cloud (Singapore) Private Limited | IPIDEA Relay Server |
- IP Address
- 43.102.2.0
- ASN
- AS45102
- Provider
- Alibaba Cloud (Singapore) Private Limited
- Description
- IPIDEA Relay Server
- IP Address
- 43.102.2.1
- ASN
- AS45102
- Provider
- Alibaba Cloud (Singapore) Private Limited
- Description
- IPIDEA Relay Server
- IP Address
- 43.102.2.2
- ASN
- AS45102
- Provider
- Alibaba Cloud (Singapore) Private Limited
- Description
- IPIDEA Relay Server
- IP Address
- 43.102.2.3
- ASN
- AS45102
- Provider
- Alibaba Cloud (Singapore) Private Limited
- Description
- IPIDEA Relay Server
- IP Address
- 43.102.2.4
- ASN
- AS45102
- Provider
- Alibaba Cloud (Singapore) Private Limited
- Description
- IPIDEA Relay Server
- IP Address
- 43.102.2.7
- ASN
- AS45102
- Provider
- Alibaba Cloud (Singapore) Private Limited
- Description
- IPIDEA Relay Server
- IP Address
- 43.102.2.11
- ASN
- AS45102
- Provider
- Alibaba Cloud (Singapore) Private Limited
- Description
- IPIDEA Relay Server
- IP Address
- 43.102.2.12
- ASN
- AS45102
- Provider
- Alibaba Cloud (Singapore) Private Limited
- Description
- IPIDEA Relay Server
File Observables
| SHA-256 | Filename | Description |
|---|---|---|
aef34f14456358db91840c416e55acc7d10185ff2beb362ea24697d7cdad321f | PacketSDK.dll | PacketSDK Windows DLL |
b0726bdd53083968870d0b147b72dad422d6d04f27cd52a7891d038ee83aef5b | PacketSDK.apk | PacketSDK Android APK |
2d1891b6d0c158ad7280f0f30f3c9d913960a793c6abcda249f9c76e13014e45 | HexSDK.apk | HexSDK Android APK |
9479da1c597ffa05d262b6fcb2717ef775876ac14dc163a30f1e372b81a31c76 | PowerVPN (Premium)\_2.4 by ANiK555_enc.apk | PowerVPN trojanized app |
59cbdecfc01eba859d12fbeb48f96fe3fe841ac1aafa6bd38eff92f0dcfd4554 | RadishVPN.apk | RadishVPN trojanized app |
- SHA-256
aef34f14456358db91840c416e55acc7d10185ff2beb362ea24697d7cdad321f- Filename
- PacketSDK.dll
- Description
- PacketSDK Windows DLL
- SHA-256
b0726bdd53083968870d0b147b72dad422d6d04f27cd52a7891d038ee83aef5b- Filename
- PacketSDK.apk
- Description
- PacketSDK Android APK
- SHA-256
2d1891b6d0c158ad7280f0f30f3c9d913960a793c6abcda249f9c76e13014e45- Filename
- HexSDK.apk
- Description
- HexSDK Android APK
- SHA-256
9479da1c597ffa05d262b6fcb2717ef775876ac14dc163a30f1e372b81a31c76- Filename
- PowerVPN (Premium)\_2.4 by ANiK555_enc.apk
- Description
- PowerVPN trojanized app
- SHA-256
59cbdecfc01eba859d12fbeb48f96fe3fe841ac1aafa6bd38eff92f0dcfd4554- Filename
- RadishVPN.apk
- Description
- RadishVPN trojanized app
Provider pool activity
events and unique IPs over time, UTC last 7 days
Top countries
unique IPs by country
Traffic mix
provider classifications
Provider intelligence
Get access to the full data.
Subscribe to access countries, traffic mix, network rankings, raw IPs, subnets, related pools, and alerts.