Infrawatch

Foreign-controlled proxy network "DSLRoot" has deployed hardware in 300+ U.S. homes across 20+ states-including military residences. Full investigation now live: infrawatch.app/blog/dslroot-u…

A single platform powers 87 SIM farm proxy networks across 17 countries, this was fun looking into it! Definitely worth the read.

This is now live here: #blogpost" target="_blank" rel="nofollow noopener">infrawatch.com/blog/inside-th…

Infrawatch identified 87 SIM farms across 17 countries, 24 commercial proxy providers, 35 cellular providers, 94 phone-farm locations across North America, Europe & South America, including a distributed presence across 19 U.S. states. Report coming tomorrow.. 👀🚜📱

👀 NEW FROM US: Infrawatch identified 87 SIM farms across 17 countries. SIM farms are now for sale, to anyone. We’ve uncovered a service that enables anyone, regardless of technical skill, to operate their own SIM farm. #blogpost" target="_blank" rel="nofollow noopener">infrawatch.com/blog/inside-th…

Following today’s NCSC + U.S. DOJ disclosures on APT28 DNS hijacking activity, Infrawatch identified at least 18.6K likely victims across 87 countries. We’ve published a victimology dashboard with victim breakdowns and a public IP checker: #blogpost" target="_blank" rel="nofollow noopener">infrawatch.com/blog/apt28-dns…

The foundations are being laid. 2026 is when it gets real. 🚀

@HansBricks3 @vxunderground Thank you Hans, sorry to hear that, could you email us please instead? hello@infrawatch.app

hey @infrawatch_app , I had issues signing up for the beta… help pls. And thanks @vxunderground for sharing! Awesome read , you’ve done some good OSINT @infrawatch_app !!!

@virusbtn Thank you for the mention!

Infrawatch researchers look into DSLRoot, a distributed residential proxy network across U.S. infrastructure, using hardware deployed in at least 20 states. infrawatch.app/blog/dslroot-u…

@gleeda Hey Jamie, thank you for bringing this to our attention. What browser is this?

@infrawatch_app the IOCs at the end are black text on black background, so a little hard to see. at least you can copy them though 😓

Foreign-controlled proxy network "DSLRoot" has deployed hardware in 300+ U.S. homes across 20+ states-including military residences. Full investigation now live: infrawatch.app/blog/dslroot-u…

Also see Brian's post here: krebsonsecurity.com/2025/08/dslroo…. This was a great collaboration which led us down new paths to investigate! 🤖

New research Tuesday: How is a Belarus company convincing US military personnel to install network devices in their homes? Our investigation into DSLRoot reveals Americans are unknowingly helping foreign actors build proxy infrastructure on US soil.

A sneak peek at our dashboard 👀 Hunt threats across VPN, malware, residential proxy and internet-scanning data in real-time. Get instant context across the entire internet. 🥇 Be among the first - BETA access still accepting applications: infrawatch.app/beta-access

Infrawatch researchers explore GhostSocks, a Golang-based SOCKS5 backconnect proxy malware, detailing its integration with LummaC2 and its command-and-control infrastructure. infrawatch.app/blog/ghostsock…

GhostSocks: A SOCKS5 backconnect malware enhancing LummaC2 infections. Our latest analysis covers its technical details, infrastructure, and how it improves credential fraud success. Learn more about about GhostSocks here 👉🏻 infrawatch.app/blog/ghostsock…

No more waiting on predefined scans from third-party tools. Customise probes, target specific IPv4/IPv6 ranges, ASNs, countries, or the entire 🌎 - and act immediately. Probe deeper into the internet. 👉🏻 infrawatch.app/blog/introduci…