← Research

A Hola-t of Proxies: The 'Free VPN' Feeding Bright Data

Jonathan Tomek · July 22, 2026 · proxy networks threat intelligence browser extensions

Last time we put the Grass extension on the bench and watched a logged-out browser get drafted as a proxy node in under a minute. Grass at least sells itself as a proxy network: the bandwidth-for-tokens pitch is the product.

This one doesn't. This one calls itself a free VPN. It's Hola, it has shipped for over a decade, and when you install it, your browser quietly registers itself into Bright Data's commercial residential-proxy pool, the same network, rebranded, that got Hola named in a 2015 botnet scandal and never really stopped.

Same rig as before: disposable VM, locked-down browser user, intercepting proxy, hard sinkhole. Nothing relayed. Here's the tape.

A node arming itself

Grass announced itself with a clean little REST handshake. Hola is chattier. It beacons its status to a telemetry endpoint as it comes online, and the sequence reads like a node powering up:

POST https://perr.hola.org/client_cgi/perr?id=be_up&product=cws&...
POST .../perr?id=be_install
POST .../perr?id=be_background_init_ok
POST .../perr?id=be_mode_change
POST .../perr?id=be_ab_test_selected
POST .../perr?id=be_svc_monitor_exec.callback     (x4)
POST .../perr?id=be_connectivity_check_success
POST .../perr?id=be_connectivity_check_failed     (x5)

be_up → be_install → background_init_ok → a service monitor calling back on a loop. Note product=cws: Hola's own telemetry tags this as its Chrome Web Store build. This is the official extension, reporting home about the health of the node it just spun up on your machine.

Then it does the thing that matters: it hands your address to the pool.

GET https://client.x-cdn-static.com/client_cgi/fetch_info?ext_ver=...
  ← { "req": { "ip": "70.18.254.71", "country": "US" }, "ver": "1.256.292" }

That is your public IP and country, read back to you by the infrastructure, the network confirming what it just catalogued. In pool terms, you're now listed inventory: a US residential exit, ready to be rented.

The relay path comes up alongside it:

GET https://zagent2007.hola.org:22224/ajax_via_proxy

ajax_via_proxy is the peer-relay conduit, the mechanism that routes a paying customer's request out through your browser. Run it twice and the zagent number changes (zagent2007, then zagent1626): a rotating pool of relay agents, exactly the "IP churn choreography" the anatomy post flagged as an operator tell.

The parent company, named by its own website

Here's the part you don't usually get handed for free. When the extension opens Hola's welcome page, the page loads this:

https://brightdata.com/wp-content/themes/brightdata/assets/js/webgl_collector.js

A script served from brightdata.com, pulled in by hola.org's own front end. You don't have to trace shell companies or licensing layers to connect Hola to Bright Data. Hola's website does it for you, in a <script> tag. Bright Data is the commercial residential-proxy business (formerly Luminati); Hola is the consumer front end that supplies it with homes. The "free VPN" is the recruiter. Bright Data is the employer. You're the temp who never saw a paycheck.

Different living room, same network

We are not the only ones who've been pulling on this thread, and the corroboration is worth sitting with.

In June, Include Security published an analysis of Bright Data's SDK on smart TVs and iOS: Samsung, LG, Roku, Vizio; brdsdk.framework; partner apps reaching a quarter-billion households. Their indicators and ours line up like two halves of a torn bill:

Include Security (smart TV / iOS)      Us (Chrome)
------------------------------------   ----------------------------------
proxyjs.brdtnet.com  (wss :443)        hola.org / perr.hola.org / zagent*.hola.org
clientsdk.bright-sdk.com               brightdata.com script on hola.org's welcome page
proxyjs.luminatinet.com                x-cdn-static.com pool registration

Different platform, different research team, different capture. Same Bright Data network. Their SDK even pins traffic to the physical interface (en0, pdp_ip0) specifically to bypass VPN inspection on the device. Read that twice: proxyware built to evade the exact category of tool Hola sells itself as.

Why anyone bothers: the AI-scraping economy

The demand side is having a moment, and it explains the land-grab. Modern anti-bot services (Cloudflare, DataDome, HUMAN) are good at spotting datacenter IPs. If you're scraping the web at scale to feed a model, a residential IP is the difference between "legitimate household" and "blocked." That's the whole value proposition of the pool your browser just joined.

Include Security put a number on your share of it: on default settings, roughly 500 MB of someone else's traffic per month flowing through your connection, with relaxed limits in some countries, presumably where the operator judges the reputational risk to be lower. You are subsidizing someone's training-data pipeline, on your bill, in your name.

Indicators

# Hola / Bright Data — browser exit-node enrollment (confirmed 2026-07)
sample         Hola VPN v1.255.748 (Chrome; product=cws)
  ext_id       gkojfkhlekighikafcpjkiklfbnlmeio
  sha256       05f9b2eaa86e16c989057c179b4deba4739c4b8a1bf3ade37dd3bfec68c8bb21
  sha1         4f466b2104a3d617494418b48522f1f71be58780
  md5          9586050f8cc0a3374cecd46ee882e236
  permissions  proxy, webRequest, tabs, declarativeNetRequest, *://*/*

# Hola node infra (TLS CN=*.hola.org, sha256 f2ab871992c50ab0…)
host   perr[.]hola[.]org            # /client_cgi/perr node telemetry   AWS AS14618
host   zagent*[.]hola[.]org:22224   # /ajax_via_proxy peer relay        (agent # rotates)
host   client-cdn4[.]hola[.]org     # bext_config.json                  Bunny CDN AS200325 / Datacamp AS212238
signal brightdata[.]com script loaded by hola.org/welcome   # the operator link, in the clear

# Shared Bright Data / Luminati infra (cross-confirmed w/ Include Security S5):
host   proxyjs[.]brdtnet[.]com      # wss peer tunnel   AWS AS16509  TLS CN=*.brdtnet.com
host   clientsdk[.]bright-sdk[.]com # SDK config        AWS AS14618  TLS CN=*.bright-sdk.com
host   proxyjs[.]luminatinet[.]com, brd[.]superproxy[.]io (DigitalOcean AS14061), zproxy[.]lum-superproxy[.]io

# Rotating peer/config CDNs (x-cdn-static reg 2023-03-13, AWS; unstable, not sole markers):
host   x-cdn-static[.]com, su89-cdn[.]net, c6gj-static[.]net, kbz0pwvxmv[.]com

The honest part

• We confirmed the node arming itself and registering into the pool. We did not capture a completed relay, and there's a tell in why. Those be_connectivity_check_failed beacons? That's Bright Data probing whether it can actually reach your node to use it as an exit. Behind our containment, those checks fail, so the network never promotes the node to live duty. The isolation that keeps us ethical is the same thing that stops the money shot. On an unsandboxed install, the checks pass.
• None of this is a scoop. Hola's proxy business has been public since 2015. That's arguably the more damning frame: this isn't a clever new supply-chain attack, it's a decade-old one still shipping to millions, now feeding an AI-scraping boom that gives it more reason than ever to want your address.

What to take from it

If you weigh "residential IP, right country" as a trust signal in a fraud or access decision, understand what's manufacturing that signal: a "free VPN" and a commercial data company, shaking hands over an unpaid node that happens to be someone's browser. The fix is the same as it's always been: track the operators, their SDKs, and their infrastructure, not their momentary exits.

Next in the series: how we find these at scale across an extension store that has no "list everything" button, and the part where being honest means admitting most of what we tested wasn't a proxy node, and saying so out loud.

Every indicator in this series is compiled in the defanged IOC appendix: hashes, live C2, ASNs, and TLS fingerprints for each confirmed family, formatted for detection and blocking (CSV).