Popa
Popa is an Android proxyware SDK and botnet component that enrolls consumer devices—including phones, tablets, streaming boxes, and unofficial Android TV boxes—into a residential proxy network. Reporting describes it as a communications-layer plugin associated with the Vo1d ecosystem and as a long-running Android-based botnet that has operated for roughly four years at large scale, with estimates ranging from about 1.5 million to 2.5 million distinct IPs per day. Popa has been linked in public reporting to advertising fraud, account takeovers, mass data scraping, and broader proxy abuse.
Functionally, Popa registers infected or enrolled devices with control infrastructure, maintains long-lived encrypted/TLS connections, receives relay server lists, and opens tunnels on demand to arbitrary destinations. Mentioned protocol elements include Register, Register Reply, Ping/Pong, Open Tunnel, Tunnel Status, Tunnel Message, and Close Tunnel. Reported registration and control paths include /initreq and /devicereg, with control or related domains including gmslb[.]net, safernetwork[.]io, tera-home[.]com, ninjatech[.]io, sdk.netnut.io, cyberprotector.online, and a decrypted Google Drive-delivered C2 value of nice-protect.com. Popa was specifically described as contacting lb.<C2>:5002/devicereg and receiving a peer_servers or servers list; closely related infrastructure observed in linked research used lb.gmslb[.]net:443/regdev and relay/front domains such as viki-play[.]com and star-layer[.]com.
Distribution has been observed through third-party Android apps, especially streaming, IPTV, utility, pirated, or modified TV applications. Named apps referencing Popa infrastructure include CRICFy, DooFlix, Sprozfy, RTS Tv, Flixoid, CyberFlix, Rapid Streamz, TvMob, and HD/OceanStreams. Synthient reported that analyzed samples often began relaying third-party traffic when the host app launched and that none of more than 20 observed publishers invoked the optional consent prompt present in Popa version 2.7.46.
The malware family has multiple related labels and variants, including Moneytiser, Loopop, Neupop, Hopanet, and Popanet. Reported package names include io.moneytise, io.popanet, io.nn.lp, io.nn.neunative, and io.nn.nativesdk. Later releases reportedly added fallback domains, Google Drive-hosted configuration, DNS-over-HTTPS, and a native variant intended to avoid detection. Synthient analyzed Popa version 2.7.46 from Android app com.ap.loveornot.
Researchers linked Popa’s backend and tunnel architecture to the Neunative proxy SDK and to RoboVPN’s bundled Neunative component, concluding these are different clients for the same proxy backend. Nokia Deepfield also reported a weak destination filter in the shared SDK design that blocks some private and reserved ranges but misses 0.0.0.0/8 and lacks a port blocklist, enabling a documented path to local ADB exposure via 0.0.0.0:5555 on Android- and Linux-class devices.
Public reporting cited in the content links Popa operationally to NetNut/Alarum Technologies, while noting that Alarum and NetNut denied operating a botnet or controlling the cited infrastructure. High-confidence observations in the content include direct communication by Popa-related samples with sdk.netnut.io and a controlled test showing traffic sent through gw.netnut.net:9595 emerging from a host running the Popa SDK.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
10 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
1 technique
Execution
Stealth
2 techniques
Stealth
Command and Control
7 techniques
Command and Control
Since then, the SDK has continued to be developed, with later releases including features such as fallback domains, Google Drive-hosted configurations, DNS-over-HTTPS (DoH), and a native variant to avoid detection.
The SDK contacts lb.gmslb[.]net:443 (TLS) with an HTTP GET that reads like a browser doing its best impression of itself: GET /regdev?usr=<uuid>&userid=<uuid>&dev_ip=<ip>&sdkv=8.0.36&inst=<uuid> HTTP/1.1 | For each peer server, the SDK opens a TLS connection on port 6000 and speaks a proprietary binary protocol... The message types, recovered from the factory and RTTI symbols: Register, RegisterResponse, Ping, OpenTunnel, TunnelMessage, CloseTunnel, Goodbye.
Since then, the SDK has continued to be developed, with later releases including features such as fallback domains, Google Drive-hosted configurations, DNS-over-HTTPS (DoH), and a native variant to avoid detection.
Bundled in the same installer, registered as a NuGet dependency, and activated whenever the VPN is not connected, is Neunative: a residential-proxy SDK that turns the user's machine into an exit node for third-party traffic.
Popa appears designed with a singular purpose: Implementing a persistent communications layer capable of registering a device, maintaining long-lived encrypted connections, and opening communication tunnels on demand.
As Synthient documented, a vulnerable proxy SDK is itself an initial-access vector: a customer who tunnels to a node's own 0.0.0.0:5555 reaches the exit device's ADB daemon and recruits it into whatever the operator is building, DDoS botnets included.
The hostnames in peer_servers are rotating front domains. For a single fleet the director returns both sN.viki-play[.]com:6000 and sN.star-layer[.]com:6000 ; the server numbers overlap... The sN identifier and IP are the stable node identity. The domain is disposable.
IOCs tracked for this family
69 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Android-based botnet/plugin used on consumer TV boxes to create a persistent communications layer, maintain long-lived encrypted connections, and open communication tunnels on demand so infected devices can function as residential proxy nodes for fraud, account takeover activity, and mass scraping.
Android residential proxy SDK that turns host devices into residential proxy nodes and relays third-party traffic through enrolled consumer devices. Later versions include fallback domains, Google Drive-hosted configurations, DNS-over-HTTPS, and a native variant to avoid detection.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.