The Proxy Empire

I. The Origin Story: A Free VPN With a Price

In late 2012, two Israeli entrepreneurs launched a product that would eventually control more residential IP addresses than any government's surveillance apparatus.

Ofer Vilenski and Derry Shribman were not newcomers. Their track record was a masterclass in building things that get acquired:

Hola VPN was beautiful in its simplicity. Instead of routing traffic through expensive data centers like every other VPN, Hola used a peer-to-peer architecture. Your traffic went through another user's device. Their traffic went through yours. No servers needed. Free for everyone.

The investors understood the scale potential immediately:

By November 2016, Hola had 100 million users. Free, frictionless, viral. The product was perfect.

But the product was never the VPN. The product was the users.

II. The Monetization: $20 Per Gigabyte of Your Bandwidth

In 2014, two years after Hola launched, a new company quietly appeared: Luminati Networks. It was a division of Hola. And it sold something that Hola's 100 million users didn't know they were providing.

Luminati offered residential proxy services. Clients could route their web traffic through real residential IP addresses — IP addresses that belonged to real people, on real ISP connections, in real homes.

The price: $20 per gigabyte.

The source of those residential IPs: every free Hola user's device.

The economics were extraordinary. Hola had zero infrastructure cost for its proxy network. Every user WAS the infrastructure. The margins approached those of a software company with the scale of a telecom.

And for over a year, almost nobody noticed.

III. The Exposure: 8chan and the Forced Disclosure

In May 2015, Fredrick Brennan — founder of the imageboard 8chan — noticed something alarming. His website was being hit by a DDoS attack. When he traced the source, the traffic was coming from Hola users' devices.

Hola's peer-to-peer architecture meant that anyone who paid Luminati could direct traffic through any Hola user's connection. Including attack traffic. Including DDoS floods. Brennan's 8chan was being attacked through Hola users who had no idea their computers were participating.

The exposure created a brief scandal. Tech media covered it. Some users uninstalled. But Hola's growth barely paused. By 2016, they hit 100 million users anyway. The lesson was clear: disclosure doesn't stop growth when the product is free.

But something else happened. Luminati's commercial value had been proven. And someone with deep pockets noticed.

IV. The Acquisition: London Private Equity Buys the Network

In August 2017, EMK Capital — a London-based private equity fund — acquired 75.6% of Luminati Networks from Hola for $125 million, valuing the entire proxy business at $165 million.

Read that again. A London PE fund paid $125 million for the right to sell other people's bandwidth.

The pattern should look familiar to readers of this series. An Israeli-founded company, performing Israeli operations, with Israeli personnel — but majority ownership registered in London. When regulators come looking, they find a British PE fund. When the technology is traced, it leads to Israel. The jurisdiction gap is the product.

In March 2021, Luminati Networks was renamed Bright Data. New name. Same network. Same model. And under CEO Or Lenchner, a dramatically expanded ambition.

By 2026, Bright Data claims 400 million residential IPs, of which 150 million+ come from its SDK. Revenue estimated at $500 million+ per year.

The $20/gigabyte exit node scheme had become a half-billion-dollar enterprise.

V. The Smart TV Infiltration: 250 Million Households

On June 5, 2026, Include Security and independent researcher Buchodi published findings that redefined the scale of Bright Data's infrastructure. They had reverse-engineered the iOS SDK that Bright Data embeds in consumer apps.

What they found went beyond phones.

A smart TV is the perfect proxy node. It is:

• Always on — plugged into the wall, not battery-dependent
• Always connected — hardwired or on strong WiFi
• Effectively unmetered — home broadband has no meaningful cap
• Never monitored — no MDM, no security tools, no user awareness
• Unwatched — the device is watched, the network traffic is not

The SDK configuration confirmed this design philosophy: ignore_screen_on=true, ignore_on_call=true. The device operates as a proxy even while you're watching television. The default bandwidth allocation: 200 GB per month per device on WiFi.

Bright Data notified of the research on May 11, 2026. No response before publication.

After the research was published, Google, Amazon, and Roku restricted background proxy SDKs. Bright Data dropped those platforms. But as of June 2026, it still lists Samsung's Tizen and LG's webOS as supported.

VI. The SDK Architecture: Designed for Invisibility

The Include Security analysis revealed an SDK architecture that goes beyond simple proxy functionality. It is engineered to be invisible — to users, to security tools, and to network monitoring.

Two features demand special attention:

The VPN bypass. On iOS, the SDK uses Apple's NWParameters.requiredInterface API to bind directly to the physical WiFi or cellular adapter. If the user has a VPN configured — even a corporate VPN — the SDK's traffic bypasses it entirely. Bright Data called this "an unintended bug" and said they would fix it. But the code was specifically written to use a non-standard API that accomplishes exactly this bypass.

The instrumentation defeat. The SDK uses CFHTTPMessage instead of the standard URLSession for its control plane. This means standard iOS security monitoring tools — the tools that enterprises and security researchers use to inspect app network traffic — cannot see it. This is not a bug. This is architecture.

In some countries (Uzbekistan, Oman), the SDK configuration set far higher bandwidth limits, allowing devices to relay traffic almost until the battery died. Bright Data called these "temporary legacy rules" that had been removed.

VII. The Philippines Attack: Proxy Infrastructure as Weapon

In August 2021, Karapatan — a Philippine human rights organization that documents extrajudicial killings — came under a sustained DDoS attack. It lasted 25 days.

Qurium Media Foundation, a Swedish digital forensics organization, investigated. What they found connected the attack directly to Bright Data's infrastructure.

Read the Qurium headline again: "Israeli firm Bright Data (Luminati Networks) enabled the attacks against Karapatan."

This is not speculation. This is forensic evidence. The HTTP headers identified Luminati infrastructure. The IP rotation patterns matched commercial proxy pool behavior. The super-proxy domains were Luminati-registered infrastructure.

A Philippine human rights organization documenting government killings was attacked for 25 days using infrastructure built from the bandwidth of people who thought they had a free VPN.

Bright Data's position: they are a neutral infrastructure provider and do not control how customers use the network. This is the identical argument made by every bulletproof hosting provider we've documented in 30+ dossiers.

VIII. The Legal Immunity: Beating Meta and Twitter

In January 2023, Meta Platforms sued Bright Data for scraping Facebook and Instagram data. The lawsuit contained a devastating irony: Meta had previously hired Bright Data to scrape competitor websites.

In January 2024, a San Francisco federal judge ruled that Bright Data had not breached Meta's terms of use. Denied Meta's summary judgment.

In July 2023, X Corp (Twitter) sued Bright Data for data scraping. In May 2024, the judge dismissed the case entirely, ruling:

Two of the world's largest social media platforms — with combined legal budgets in the billions — sued the same Israeli proxy company. Both lost.

The legal precedent is now established: residential proxy scraping is lawful. Courts have validated the infrastructure. The business model that started by selling free VPN users' bandwidth at $20/GB now has legal immunity from the companies it scrapes.

Bright Data maintains a "Trust Center" with PwC audit reports, AppEsteem certification, and ISO/SOC 2 attestations. CEO Or Lenchner told The Hacker News: "A device in its network is a device whose owner said yes, understood what they were saying yes to, and can say no again at any moment with two steps."

Whether a smart TV owner reading "occasionally use free resources" understands they're consenting to 200GB/month of proxy traffic is an open question the courts haven't been asked.

IX. The AI Scraping Machine: Why Scale Matters Now

What changed between 2015 and 2026 is the buyer.

In 2015, Luminati's customers were ad verification companies, price comparison services, and SEO analysts. In 2026, the primary demand driver is AI training data collection.

The ecosystem context makes this clearer:

• October 2025: Krebs on Security reported that proxies from botnets like Aisuru were fueling large-scale AI data harvesting
• January 2026: Google dismantled the IPIDEA proxy network — a criminal operation hijacking consumer devices
• June 2026: Include Security revealed Bright Data's SDK in smart TVs — a consent-based version of the same model

Bright Data's argument: their SDK-sourced IPs are opt-in, unlike criminal botnets. That consent screen is the line between "legitimate business" and "criminal network." But both turn consumer devices into exit nodes for commercial traffic. Both use residential IPs to bypass anti-bot defenses. Both serve the same AI training data market.

The difference is a dialog box.

X. The Killed Competition: GeoSurf and Patent Warfare

Bright Data didn't just build a monopoly through growth. It eliminated competitors through litigation.

Bright Data also won a $7.5 million patent judgment against Oxylabs (Lithuanian competitor). The pattern: Bright Data patents the proxy infrastructure model, then uses US courts to extract settlements or kill competitors.

The residential proxy market is increasingly an Israeli near-monopoly:

Three of the top five residential proxy companies are Israeli. One was killed by another Israeli company. The survivor controls more IPs than any nation-state surveillance program has ever documented.

XI. The Honeypot Connection: We've Seen This Model Before

Our honeypot doesn't contain Bright Data IPs directly — and it shouldn't. Bright Data is the infrastructure provider, not the attacker. But we have documented the exact same operational model in the wild.

The connection goes deeper. In TI-002, we documented residential botnet nodes across Armenia, Russia, South Korea, Indonesia, and Thailand — all on residential ISPs. These are the same type of nodes that compose Bright Data's "consent-sourced" pool: residential connections, residential IPs, residential bandwidth.

The difference between a criminal residential proxy botnet and Bright Data's SDK is a consent dialog. The infrastructure is identical.

XII. The Invisible Map: Kape + Bright Data = The Privacy Circle

This is where the 034 series connects.

Israeli-founded companies now control both sides of internet privacy infrastructure:

A user who installs a Kape-owned VPN for privacy may have their traffic routed through infrastructure that Bright Data's SDK has turned into proxy nodes. The VPN they trust is Israeli-founded. The proxy network their traffic travels through is Israeli-founded. The review site that recommended the VPN is Israeli-owned.

This is not conspiracy. This is documented corporate structure. The privacy ecosystem is circular, and Israeli-founded companies own the circle.

Cross-reference with 034A: Israel appears in our honeypot with 7 IPs and zero hits. But Israeli-founded companies control infrastructure that touches hundreds of millions of devices globally. The absence isn't absence. It's architecture.

XIII. Investigative Q&A

XIV. Conspiratorial Q&A