# Browser Proxyware — Indicators of Compromise **MadX LLC · Threat Intelligence** — companion appendix to the *Residential Proxy Economy* series. - **Author:** Jonathan Tomek - **Version:** 1.0 · 2026-07-23 - **Scope:** Chrome extensions dynamically confirmed to enroll a browser as a residential-proxy exit node, plus the samples tested that did **not** trigger a catalogued reseller SDK under passive load. --- ## How to read this document **All indicators are defanged.** Re-fang before use in tooling: | Defanged | Real | | --- | --- | | `example[.]com` | `example.com` | | `hxxps://…` | `https://…` | | `45[.]38[.]56[.]0/24` | `45.38.56.0/24` | **Confidence — how the subject was established:** - **L2 (confirmed exit-node behavior)** — captured, in decrypted traffic, the extension being enrolled *and* tasked to relay third-party traffic. This is the bar at which we name a subject publicly. - **L1 (confirmed enrollment)** — captured pool registration + relay-endpoint wiring + node-arming lifecycle, but not a completed inbound relay task. - **Tested / no passive trigger** — run in the same rig; did not reach for a *catalogued* reseller SDK on a cold, logged-out load. **This is not a clearance** (see the caveat in §3). **Enrichment** (ASN / hosting / TLS) is point-in-time (July 2026) and rotates. Treat behavior — the enrollment *pattern* — as the durable signal; treat hostnames and IPs as perishable. --- ## 1. Grass — CONFIRMED exit-node enrollment + relay tasking (L2) A logged-out, guest browser is auto-classified `SELLER` and handed relay bridges within seconds of install. No account, no opt-in click. ### Sample ```text name Grass Lite Node v7.5.2 (Chrome) ext_id ilehaonighjijnmpnagapkhpcdbhclfg sha256 8ea2dd825e27e17a4a673bcd946d4af3cef0fa45f7c33754ea33d44bfcbc450b sha1 dda1d8dd3db61700cf24f9d1c8438e006b5470fb md5 4df3ed45deca334abb3a5bf725f7d7ee permissions background, webRequest, declarativeNetRequestWithHostAccess, ``` ### C2 — live infrastructure Cloudflare-fronted (AS13335); all share TLS `CN=grass.io` (SHA-256 fingerprint leads `244e1a3f3677c90b…`). | Host (defanged) | Role | | --- | --- | | `api[.]grass[.]io` | `POST /registerGuestProcedure`, `/devices/register` → SELLER token | | `director[.]grass[.]io` | `POST /devices/checkin` → `{bridge_ip, token}` (relay tasking) | | `prism-cf[.]grass[.]io` | `GET /ip` (public-address takedown) | ### Relay infrastructure — operator-owned ```text 45[.]38[.]56[.]0/24 AS23511 "Grass DataCo (BVI) Ltd." — Grass's OWN ASN bridges e.g. .208 / .225 / .255, handed out on rotation ``` Decoded relay target observed in a bridge token's `aud` claim: `162[.]158[.]78[.]94` (the third party the browser was authorized to carry for). ### Legacy markers (still in the manifest; no longer the live C2) ```text getgrass[.]io proxy2[.]wynd[.]network ``` ### Durable detection signal The manifest strings are stale — hunt the *behavior*: `registerGuestProcedure` → `SELLER`-scope token → `devices/checkin` → `45[.]38[.]56[.]0/24` bridge. Note: the network rate-limits its own supply (`429` on `registerGuestProcedure` after repeated enrollments from one egress). --- ## 2. Hola / Bright Data — CONFIRMED enrollment (L1, borderline L2) Installing this "free VPN" registers the browser's IP into Bright Data's (formerly Luminati) commercial residential-proxy pool. Bright Data's own code loads off Hola's welcome page — the operator link, in the clear. ### Sample ```text name Hola VPN v1.255.748 (Chrome; product=cws) ext_id gkojfkhlekighikafcpjkiklfbnlmeio sha256 05f9b2eaa86e16c989057c179b4deba4739c4b8a1bf3ade37dd3bfec68c8bb21 sha1 4f466b2104a3d617494418b48522f1f71be58780 md5 9586050f8cc0a3374cecd46ee882e236 permissions proxy, webRequest, tabs, declarativeNetRequest, *://*/* ``` ### Hola node infrastructure TLS `CN=*.hola.org` (SHA-256 fingerprint leads `f2ab871992c50ab0…`). | Host (defanged) | Role | Hosting | | --- | --- | --- | | `perr[.]hola[.]org` | `/client_cgi/perr` node telemetry | AWS AS14618 | | `zagent*[.]hola[.]org:22224` | `/ajax_via_proxy` peer relay (agent # rotates) | — | | `client-cdn4[.]hola[.]org` | `bext_config.json` | Bunny CDN AS200325 / Datacamp AS212238 | | `client[.]x-cdn-static[.]com` | `/client_cgi/fetch_info` — IP→pool registration | AWS | Operator link, captured on the wire: `hxxps://brightdata[.]com/wp-content/themes/brightdata/assets/js/webgl_collector.js` loaded by `hola[.]org`'s welcome page. ### Shared Bright Data / Luminati infrastructure Cross-confirmed with Include Security's independent smart-TV / iOS analysis (see Sources) — same network, different platform. | Host (defanged) | Role | Enrichment | | --- | --- | --- | | `proxyjs[.]brdtnet[.]com` | wss peer tunnel | AWS AS16509 · TLS `CN=*.brdtnet.com` | | `clientsdk[.]bright-sdk[.]com` | SDK config | AWS AS14618 · TLS `CN=*.bright-sdk.com` | | `brd[.]superproxy[.]io` | superproxy entry | DigitalOcean AS14061 | | `proxyjs[.]luminatinet[.]com` | wss peer tunnel | — | | `zproxy[.]lum-superproxy[.]io` | superproxy entry | — | ### Rotating peer / config CDNs Unstable — do not use as sole markers (`x-cdn-static[.]com` registered 2023-03-13, AWS): ```text x-cdn-static[.]com su89-cdn[.]net c6gj-static[.]net kbz0pwvxmv[.]com ``` ### Node-arming lifecycle (telemetry beacon sequence) ```text be_up → be_install → be_background_init_ok → be_mode_change → be_ab_test_selected → be_svc_monitor_exec.callback (x4) → be_connectivity_check_{success,failed} ``` --- ## 3. Tested — no reseller SDK triggered under passive load The following were run in the same rig on a cold, logged-out load and did **not** reach for a catalogued bandwidth-reseller SDK. > **This is not a clean bill of health.** We did not log in or click > "connect," and an SDK that only wakes mid-session would not have fired. > This is "did not trigger under passive load," **not** an exoneration. > Included for reproducibility and to make the capability-surface point below. ```text name ver sha256 permissions (relay-relevant) VeePN 4.0.2 a3da24cc5a5b4ab8a33b2384818a2aa98a2ccbf5f4dc0d006c6c31383fdb3d5c proxy, tabs, webRequest, NordVPN proxy 5.6.5 50f14abdcce2d268fee189192e863ba49550e36d5dd834164467787cf3e42707 proxy, webRequest, declarativeNetRequest, 1clickVPN 2.1.0 413dafaf45c1abc5c5d52296e011f9d9a03562b35f117d619b85ec0d4bda5c99 proxy, webRequest, *://*/* Browsec 3.93.7 6808984fb7ad893d3e2270d7c7e638cac854dbd7e6749044769d67e7cb0602eb proxy, webRequest, ``` **The capability-surface point:** every sample above — and both confirmed proxy nodes in §1–§2 — requests the same relay-relevant keys (`proxy` / `webRequest` / all-URL host access). The permission grant is identical whether the extension relays your traffic or not. **Capability is not behavior** — which is exactly why confirmation has to be dynamic, not manifest-based. --- ## 4. MITRE ATT&CK | Technique | ID | Note | | --- | --- | --- | | Proxy: Multi-hop Proxy | T1090.003 | Residential exit relays third-party traffic through the victim host's IP. | | Proxy (parent) | T1090 | Enrolled browser acts as an intermediary hop. | --- ## 5. Method & ethics (one paragraph) Each subject was loaded in a disposable VM as a locked-down, non-privileged browser user whose only permitted network path is a local intercepting proxy (TLS/WebSocket decrypted); all other egress is dropped at the kernel and logged. Any instruction to relay to a third party is captured and then **sinkholed** — the instruction is recorded, no third-party traffic is ever carried. A subject is named publicly only on L2 (dynamically-confirmed exit-node behavior). Captured credentials/tokens are redacted from evidence. --- ## Sources - Google Threat Intelligence Group — *Disrupting the largest residential proxy network (IPIDEA)*. - Include Security — *The Smart TV in your living room is a node in the AI-scraping economy* (2026-06): independent analysis of Bright Data's SDK on smart TVs / iOS; IOCs overlap this appendix. - Hola / Luminati botnet disclosure (2015). --- *Published by MadX LLC for defensive detection and blocking. Indicators are point-in-time; verify before enforcement.*