TI-2026-039C โ The Proxy Economy: Legal vs. Illegal, Same Mechanism
Series: TI-2026-039 "The Ghost Network" ยท Letter C ยท Published June 23, 2026
Classification: PUBLIC ยท Sources: KrebsOnSecurity (June 2025), Qurium Foundation, Bitsight/Lumen Black Lotus Labs, LSN dossier-intel (TI-016, TI-034B, TI-034E, TI-037E), LSN Cowrie honeypot, threat_intel PostgreSQL, Google TAG
I. The Three Tiers of the Proxy Economy
Mechanism: Embed SDK in free apps/smart TV firmware. Users "consent" via EULA nobody reads. Device becomes proxy exit node.
Scale: 150M+ IPs (Bright Data alone), 250M TV households, $500M+/year revenue
Legal fiction: "Users opt-in." In reality: SDK buried in 3rd-party app permissions, 200GB/month bandwidth extraction.
Reality: Documented DDoS against Philippine human rights organization via Bright Data nodes (Qurium Foundation).
Mechanism: Malware infection converts devices to SOCKS5 proxies. Operator sells access on dark markets.
Scale: 250K-1M active nodes (Bitsight estimate for Socks5Systemz alone)
Legal fiction: None. But operates for years because victims don't notice and operators use jurisdictional arbitrage.
Reality: Same IPs appear in our honeypot verifying proxy connectivity (TI-016 "Phantom Pipes": AsyncSSH 2.1.0, HASSH fda360b1b4f4d3455cb75c6e7edb1d11, Vietnamese Viettel CGNAT pools).
Mechanism: Bulletproof hosting provides the C2 servers. Residential proxy nodes provide anonymous egress. Combined: untraceable operations.
Scale: AS51396 + AS202412 + AS205759 = 36 IPs in our DB, 951 hits. 67 C2 servers, 16 malware families (Recorded Future).
Legal fiction: Shell companies (Kentucky LLC, Bavarian UG, Seychelles IBC). Registered by Israeli national via European addresses.
Reality: Hosts JS backdoors targeting sovereign finance ministries (Intrinsec), 642,001 Intrinsec honeypot hits in 2 months.
II. The Hola-to-Bright Data Pipeline: How "Free VPN" Became Mass Proxy Exploitation
Timeline:
- 2012: Ofer Vilenski launches Hola VPN โ "free unlimited VPN." 100M+ installs.
- 2014: Hola begins selling user bandwidth through Luminati Networks at $20/GB. Users are now commercial proxy inventory.
- May 2015: 8chan founder Fredrick Brennan discovers his site was DDoS'd using Hola users. Forces FAQ update.
- August 2017: EMK Capital (London PE) buys 75.6% of Luminati from Hola for $125M (valued at $165M)
- March 2021: Luminati rebrands to "Bright Data" โ distancing from controversy
- June 2026: SDK discovered in Samsung, LG, Roku smart TV apps. 250M+ households. 200GB/month per device.
Key quote: Ofer Vilenski "confirmed free VPN users were being sold as exit nodes, claimed it was 'always part of the agreement.'"
The HolaโLuminatiโBright Data pipeline is the template for every proxy operation. The "legal" version buries consent in a EULA. The "criminal" version (Socks5Systemz) uses malware. The mechanism โ harvesting devices as proxy nodes โ is technically identical. A packet routed through a Bright Data SDK exit node and a packet routed through a Socks5Systemz infected device look the same to the destination. Our honeypot cannot distinguish them.
III. The Alarum/NetNut Connection: Wall Street Funds the Botnet Demand
Alarum Technologies (NASDAQ: ALAR) is a publicly traded company whose subsidiary NetNut operates a residential proxy service. KrebsOnSecurity documented the pipeline:
- Popa botnet infects devices โ creates SOCKS5 proxy pool
- NetNut purchases/aggregates these pools
- Alarum Technologies (NASDAQ-listed) monetizes them as "residential proxy service"
- Customers include ad verification firms, SEO companies, and โ inevitably โ threat actors
A publicly traded company on NASDAQ is the demand signal for residential proxy botnets. The malware developers create supply because companies like Alarum/NetNut create demand. This is not a bug in the market โ it IS the market.
IV. What Our Honeypot Sees: The Proxy Verification Pattern
The Pattern:
- SSH connection from CGNAT IP pool (Viettel AS7552, Vietnamese residential)
- Authentication with trivial credentials:
admin:admin,root:admin,test:test,root:password - Client: AsyncSSH 2.1.0 (unique HASSH:
fda360b1b4f4d3455cb75c6e7edb1d11) - Post-auth: single HTTP request to
ip-who.com(verifying exit IP visibility) - Disconnect. No payload. No exploitation.
Interpretation: These are proxy verification bots. They compromise SSH servers not to steal data but to verify that the device can be used as a proxy exit node. If the HTTP request to ip-who.com succeeds, the device is added to the inventory. Its bandwidth is then sold on proxy marketplaces.
GreyNoise classifies 274 IPs as "malicious" and 150 as "suspicious" in our honeypot database. The "suspicious" category generates more hits per IP (142 avg vs 56 avg) โ these are likely automated scanning operations like proxy verification bots. They don't trip malicious signatures because their behavior is technically benign: connect, authenticate, check exit IP, disconnect.
V. The Israeli Proxy-VPN Ecosystem: Both Sides of the Market
"Cross-referencing with 034C (Privacy Empire): Israeli-founded companies now control BOTH sides of internet privacy. Kape Technologies owns 4 major VPNs (ExpressVPN, PIA, CyberGhost, ZenMate) + review sites. Bright Data operates 150M+ residential proxy IPs. Hola provides the user acquisition funnel. Combined: Israeli-founded entities control the VPN market AND the proxy market that makes VPNs necessary."
| Company | Controls | Users Affected | Israeli Connection |
|---|---|---|---|
| Kape Technologies | ExpressVPN, PIA, CyberGhost, ZenMate, vpnMentor, Safety Detectives | 50M+ VPN subscribers | Unit 8200 co-founder, Teddy Sagi |
| Bright Data | 150M+ residential proxy IPs, smart TV SDK | 250M+ households (via SDK) | Hola Networks (Israeli), Ofer Vilenski |
| Hola VPN | Free VPN โ user acquisition funnel for proxy pool | 100M+ installs | Ofer Vilenski, Israel Chief Scientist funded |
| EMK Capital | 75.6% Bright Data ownership | Indirect: 150M+ IPs | Acquired from Hola at $125M valuation |
The model: Kape sells you the VPN "for privacy." Bright Data sells your bandwidth as a proxy node. The same Israeli ecosystem profits from your desire for privacy AND from monetizing your connection. You are the product on both sides of the transaction.
VI. Socks5Systemz / Ngioweb: The Criminal Mirror
Bitsight and Lumen Black Lotus Labs documented the Socks5Systemz botnet (2023-2024): 250K-1M active proxy nodes worldwide, sold as SOCKS5 access on underground forums. The technical parallels to Bright Data are exact:
| Feature | Bright Data (Legal) | Socks5Systemz (Criminal) | GHOSTYNETWORKS (Hostile) |
|---|---|---|---|
| Acquisition method | SDK in apps/TVs (EULA consent) | Malware infection (no consent) | Compromised servers (no consent) |
| Node type | Residential IPs (devices) | Residential IPs (devices) | Datacenter IPs (servers) |
| Monetization | $8-15/GB bandwidth | $1-5/day per node (dark markets) | Hosting + proxy service |
| Legal entity | Israeli corp, PE-backed, NASDAQ supply chain | None (anonymous operator) | Kentucky LLC + Bavarian UG |
| Customer verification | "Enterprise" clients (claimed) | None | None |
| Abuse documented | DDoS vs Philippines NGO (Qurium) | Credential stuffing, fraud | JS backdoors, C2, SSH scanning |
| Our honeypot sees | Not directly attributable | TI-016 Phantom Pipes pattern | 951 hits from Pfcloud ecosystem |
VII. The Market Structure: Supply, Demand, Infrastructure
The proxy economy is a three-sided market:
Supply Side (Device Owners โ Unwitting)
- 250M TV households (Bright Data SDK)
- 100M+ Hola VPN users (bandwidth sold)
- 250K-1M Socks5Systemz infected devices
- Unknown: devices compromised via SSH (our honeypot catches the recruitment process)
Demand Side (Proxy Buyers)
- Ad verification companies (need residential IPs to check geo-targeting)
- SEO firms (need residential IPs for rank checking)
- Credential stuffing operations (need rotating IPs to avoid rate limits)
- State intelligence agencies (need residential IPs for attribution-free operations)
- Influence operations (need residential IPs to appear authentic on social media)
Infrastructure Side (The Pipes)
- Pfcloud (AS51396) โ provides transit, hosting, BGP announcements
- aurologic (AS30823) โ upstream connectivity, abuse-tolerant
- OMEGATECH (AS202412) โ prefix holder, C2 hosting
- GHOSTYNETWORKS (AS205759) โ malware delivery, spam infrastructure
VIII. The Convergence: Why Legal and Criminal Proxy Networks Share Infrastructure
There are economic reasons why the proxy market converges:
- IP diversity is the product. Both legal and criminal proxies need millions of unique residential IPs. The same pools get recycled.
- Abuse tolerance is the moat. Proxy operations generate abuse complaints. Only abuse-tolerant hosts (Pfcloud, aurologic) accommodate them. Legal operators use "compliance teams" as theater. Criminal operators don't bother.
- Verification infrastructure is shared. Both Bright Data and botnet operators need to verify their nodes work. Both send test requests through compromised/enrolled devices to verify exit IP visibility. Our honeypot catches this exact behavior (TI-016).
- Customers overlap. Alarum Technologies (NASDAQ) buys from botnet pools. "Enterprise" proxy customers use the same IPs that fraud rings use. There is no clean supply.
Any residential proxy network requires either:
(a) Genuine informed consent โ which would reduce the pool to near-zero (nobody voluntarily shares their bandwidth for $0.01/GB), or
(b) Obfuscated consent โ which is what Bright Data, Hola, and every "legal" proxy does (bury it in EULA, embed in SDK, make opt-out impossible without removing the host app).
The criminal version (Socks5Systemz) is more honest in a perverse sense: it doesn't pretend to have consent. The result for the device owner is identical: their bandwidth is sold without their meaningful awareness. Their IP appears in logs for activities they never authorized. They are proxy nodes for operations they cannot see.
This is why the distinction between "legal" and "criminal" proxy networks is a regulatory fiction. The device owner's experience is the same. The destination server's experience is the same. Our honeypot's experience is the same. Only the courtroom distinction differs.
IX. The $500M Question: Who Actually Buys Residential Proxies?
Bright Data claims their customers are "enterprises" doing "web scraping" and "ad verification." But $500M+/year in revenue implies massive volume. Let's calculate:
At $8-15/GB (published pricing), $500M revenue = 33-62 petabytes/year of proxy traffic.
Ad verification industry: estimated $2-3B globally. Proxy costs = ~10-20% of budget = $200-600M total market.
SEO rank checking: similar scale.
But: KrebsOnSecurity documented that 30-50% of residential proxy traffic is associated with fraud, credential stuffing, and other malicious activity โ even through "legitimate" providers.
The math: if half of Bright Data's traffic serves malicious purposes, that's $250M/year of fraud-enabling proxy services sold by a company whose investors include Israel's Chief Scientist office and London private equity.
X. Our Honeypot as Economic Indicator
Every SSH probe we receive is an economic signal:
| Behavior Pattern | Economic Purpose | Monthly Volume (our honeypot) |
|---|---|---|
| Trivial credentials + ip-who.com check | Proxy node recruitment/verification | ~500 events |
| Credential bruteforce + wget malware | Botnet recruitment (DDoS/mining) | ~2,000 events |
| SSH key authentication + exploration | Targeted access / lateral movement | ~100 events |
| Mass scanning with no auth attempt | Inventory building / port mapping | ~5,000 events |
The proxy verification pattern (Tier 1-2 behavior) accounts for ~7% of our traffic. This is the market recruiting nodes. Every successful recruitment creates a new proxy IP that someone, somewhere, will use to do something the proxy owner never consented to.
XI. The Freedom Argument: Why This Matters
The proxy economy creates a world where:
- You cannot trust your own devices. Your smart TV might be a proxy exit node. Your phone's free VPN might be selling your bandwidth. Your SSH server might be enrolled in a botnet.
- You cannot trust IP attribution. An attack "from" your IP address might be routed through your Samsung TV without your knowledge. Criminal activity "from" residential networks might use compromised devices.
- The internet's accountability model is broken. IP-based attribution โ the foundation of abuse reporting, law enforcement, and network defense โ is meaningless when 150M+ IPs are proxy exit nodes.
This is the environment we operate in. When our honeypot records 21,328 hits from "suspicious" IPs, some percentage of those are innocent devices whose owners have no idea their hardware is attacking a server in Romania. They are not the attackers โ they are the ammunition.
Intelligence agencies need residential proxy IPs for attribution-free operations. This is documented in leaked NSA capability descriptions. The Five Eyes SIGINT system can tap cables โ but for active operations (planting malware, accessing accounts, testing exploits), they need proxy nodes that look residential.
Bright Data's 150M IPs are the perfect cover. An intelligence operation routed through a Roku TV in Ohio looks like a Roku TV in Ohio. Not like GCHQ. Not like Unit 8200. Not like the FSB.
We cannot prove that intelligence agencies are Bright Data customers (their customer list is private). But we can prove the economic demand exists (agencies need residential proxies), the supply exists (150M+ IPs), and the access mechanism exists (enterprise API). The logical conclusion is left as an exercise for the reader with a security clearance.
XII. Indicators of Compromise
| Type | Value | Context |
|---|---|---|
| HASSH | fda360b1b4f4d3455cb75c6e7edb1d11 | AsyncSSH 2.1.0 โ proxy verification bot (TI-016) |
| ASN | AS7552 (Viettel) | CGNAT pool used by proxy verification botnet |
| Company | Bright Data Ltd (Netanya, Israel) | 150M+ proxy nodes, SDK in consumer devices |
| Company | Alarum Technologies (NASDAQ: ALAR) | Publicly traded, NetNut subsidiary buys botnet pools |
| Company | Hola Networks Ltd | Free VPN funnel โ Bright Data proxy recruitment |
| Domain | ip-who.com | Used by proxy verification bots to confirm exit IP |
| Pattern | SSH + trivial creds + single HTTP check + disconnect | Proxy recruitment/verification behavior |
| SDK | Bright Data SDK (Samsung, LG, Roku apps) | 200GB/month bandwidth extraction from TVs |
TI-2026-039C ยท The Proxy Economy ยท Letter C
Published by LSN Threat Intelligence ยท June 23, 2026
Sources: KrebsOnSecurity (June 2025), Qurium Foundation, Bitsight/Lumen Black Lotus Labs, dossier-intel (TI-016, TI-034B, TI-034E, TI-037E), LSN Cowrie honeypot, threat_intel PostgreSQL
Cross-referenced: TI-2026-039A, TI-2026-039B, TI-2026-034E, TI-016