IPRoyal

Evidence

1. AppEsteem listed the IPRoyal Pawns Windows app as a Deceptor on 20 Jun 2022, among other findings for not obtaining user consent to share the network connection, and marked the listing resolved on 29 Jul 2022 with version 1.13.2.673.

   Supply and public reports Low confidence Seen 23 Oct 2026 customer.appesteem.com

2. Proxyway's 2026 market research reported that IPRoyal's pool returned over 900k US IPs on little-known Comcast ASNs, some of which Comcast had already made inactive, and wrote that this "sounds suspiciously familiar to BGP hijacking".

   “IPRoyal’s proxy pool included over 900k US IPs associated with little-known ASNs belonging to Comcast.”

   Supply and public reports Low confidence Seen 23 Oct 2026 proxyway.com

3. Proxyway reported in May 2022 that IPRoyal had sold a second residential pool from multiple sources until late October 2021, when the source ended the contract, and said its data suggested IPRoyal "may still resell some" residential IPs.

   “IPRoyal used to offer two residential proxy pools: one resold from multiple sources, and one its own.”

   Supply and public reports Low confidence Seen 23 Oct 2026 proxyway.com

4. IPRoyal's Terms of Service (Version 10, effective 15 Oct 2026) named IPRoyal Services FZE LLC, incorporated in the United Arab Emirates under licence No 4387 with an Ajman address, as the service provider.

   “IPRoyal Services FZE LLC is a legal entity, incorporated in the United Arab Emirates, license No 4387”

   Web and company links High confidence Seen 23 Oct 2026 iproyal.com

5. IPRoyal's Residential Proxy Sourcing page said it sources residential IPs through Pawns.app, which it called its direct partner, and through IP service provider partnerships, with users sharing their bandwidth.

   “IPRoyal sources residential IPs through its direct partner – Pawns.app, as well as through established IP service provider partnerships.”

   Supply and public reports High confidence Seen 23 Oct 2026 iproyal.com

6. Pawns.app's Terms of Use (effective 10 Mar 2026), whose privacy policy names Pawns.App Ltd (England and Wales, 16043795), described an optional Traffic Sharing feature, available only on some devices and app versions, that routes clients' traffic via the user's connection.

   “Traffic Sharing allows Pawns.app and its business clients (“Clients”) to route internet traffic via your device and internet connection.”

   Supply and public reports High confidence Seen 23 Oct 2026 pawns.app

7. Pawns.app's business site offered app developers a Pawns.app SDK that connects their users' devices to a residential proxy network using those users' bandwidth.

   “The Pawns.app SDK enables integration with residential proxy network by leveraging user bandwidth.”

   Supply and public reports High confidence Seen 23 Oct 2026 business.pawns.app

8. Synthient's provider index (Wayback capture of 14 May 2026) listed a pool named "Wired Iproyal" with 899,814 IPs among entries named Wired Bright, Wired Oxylabs, Wired Packet and Wired Smart; Synthient gave no explanation of these names.

   “Wired Iproyal 899,814 IPs”

   Supply and public reports Low confidence Seen 23 Oct 2026 web.archive.org

9. Pawns.app's Google Play listing (package com.iproyal.android) gave the developer as PAWNS.APP LTD of London with phone +370 626 85257, the same number rekvizitai.vz.lt listed for Simoresta UAB.

   “+370 626 85257”

   Web and company links High confidence Seen 23 Oct 2026 play.google.com

10. Synthient's IPRoyal profile named BeyondProxy, LightningProxies and ProxyStore among "proxy resellers" it found "to be providing access to IPRoyal".

    “proxy resellers such as BeyondProxy, LightningProxies, and ProxyStore to be providing access to IPRoyal”

    Supply and public reports Medium confidence Seen 23 Oct 2026 synthient.com

11. Pawns.app's homepage called the app certified by security industry experts and linked to AppEsteem, whose data showed the Pawns.app certification expired on 19 Aug 2026.

    “Rest easy with Pawns.app – certified by leading antivirus and security industry experts.”

    Terms and price watch High confidence Seen 23 Oct 2026 pawns.app

12. IPRoyal's docs rotation page documented _session- (exactly 8 characters), _lifetime- (1 second to 7 days) and a _forcerandom-1 tag; MarsProxies' docs documented the same three keys with the same limits.

    “To reduce IP rotation and improve performance of your proxies, add the _forcerandom-1 tag to your proxy string.”

    Docs fingerprint High confidence Seen 23 Oct 2026 docs.iproyal.com

13. IPRoyal's Terms clause 1.1.1 on contracting group companies read word for word as MarsProxies' clause 1.1.1; 11 sentences of 12+ words matched once company names were swapped.

    “The Company may contract other persons (e.g. other group companies (if any), third party service providers)”

    Docs fingerprint Medium confidence Seen 23 Oct 2026 iproyal.com

14. Synthient's IPRoyal profile said IPRoyal uses Pawns, seen in Pawns.app, Football Fixtures Pro and AniVortex, and gave Pawns a MEDIUM risk score based on a randomized sample of consent practices.

    “IPRoyal is observed leveraging Pawns to obtain large swaths of IP addresses.”

    Supply and public reports High confidence Seen 23 Oct 2026 synthient.com

15. Proxyway's 2026 market research described IPRoyal's residential sourcing as the Pawns app plus an SDK, and said IPRoyal had started relying more on its SDK.

    “IPRoyal maintains its own residential proxy pool through an app called Pawns.”

    Supply and public reports High confidence Seen 23 Oct 2026 proxyway.com

16. Trend Micro's July 2023 paper assessed that IPRoyal very likely relied on its own Pawns.app infrastructure, and reported no KYC check: its researchers registered as a paying customer with a burner phone number and email account.

    “It is very likely that they rely on their own Pawns.app infrastructure with or without additional exit nodes.”

    Supply and public reports Medium confidence Seen 23 Oct 2026 trendaisecurity.com

17. UK Companies House listed Pawns.App Ltd (16043795, incorporated 28 Oct 2024) with one director, also its 75%-or-more owner, resident in Lithuania, whose name matched Simoresta UAB's manager on rekvizitai.vz.lt (a name match only).

    “Ownership of shares – 75% or more”

    Web and company links Medium confidence Seen 23 Oct 2026 find-and-update.company-information.service.gov.uk

18. Sysdig's Threat Research Team reported an attacker who exploited Log4j and ran the command-line IPRoyal Pawns client under the attacker's own account to earn from the victim's bandwidth; Sysdig called proxyware services themselves legitimate.

    “the Sysdig TRT correlated it to the command-line interface version of the IPRoyal Pawns application from GitHub”

    Supply and public reports High confidence Seen 23 Oct 2026 sysdig.com

19. AhnLab's ASEC reported that the attackers behind LoveMiner, who break into poorly managed MS-SQL servers, had switched to installing proxyware from IPRoyal Pawns, Traffmonetizer, Proxyrack and PacketStream on those servers.

    “they have now shifted to employing proxyware from IPRoyal Pawns, Traffmonetizer, Proxyrack, and PacketStream companies”

    Supply and public reports High confidence Seen 23 Oct 2026 asec.ahnlab.com

20. Lithuanian State Patent Bureau data shown on rekvizitai.vz.lt listed Simoresta UAB (code 303108621) as holder of registered trademarks IPRoyal, Pawns.app, MarsProxies, mars proxies and CometVPN, all filed in 2023.

    “The State Patent Bureau's public database indicates that Simoresta, UAB have 9 currently valid registerd trademarks.”

    Web and company links High confidence Seen 23 Oct 2026 rekvizitai.vz.lt

21. AppEsteem's certified-apps listing for vendor PAWNS showed Pawns.app Windows files carrying the company name IPRoyal and signed with a certificate issued to Pawns.app Ltd; the certification ran 19 Aug 2025 to 19 Aug 2026 and was marked expired.

    Web and company links High confidence Seen 23 Oct 2026 customer.appesteem.com

22. Trend Micro named IPRoyal Pawns among bandwidth-sharing apps and, from exit-node traffic it recorded from January to September 2022, listed Pawns among networks carrying SQL injection probing, crawling of national-ID data and bulk social-media sign-ups.

    “Some examples of companies using the “network bandwidth sharing” monetization scheme include HoneyGain, TraffMonitizer, Peer2Profit, PacketStream, and IPRoyal Pawns, among others.”

    Supply and public reports High confidence Seen 23 Oct 2026 trendmicro.com

23. TechRadar quoted a Pawns.app website notice saying bandwidth sharing was discontinued as of 2026; IPRoyal's sourcing page still named Pawns.app as its direct partner on 23 Oct 2026.

    “As of 2026, Pawns.app does not offer internet bandwidth sharing”

    Terms and price watch Medium confidence Seen 23 Oct 2026 techradar.com

24. AhnLab's ASEC reported that the Larva-24011 actor, which targets poorly managed IIS, Tomcat and MS-SQL servers, installed proxyware tools including IPRoyal, Traffmonetizer, Proxyrack and PacketStream on systems it had compromised.

    “installs the launcher malware “warpstrat.dll” along with proxyware tools such as Traffmonetizer, IPRoyal, Proxyrack, and PacketStream”

    Supply and public reports High confidence Seen 23 Oct 2026 asec.ahnlab.com

25. AhnLab's ASEC reported a dropper, spread through adware, that installed Peer2Profit and IPRoyal Pawns under the attacker's account without the user's permission; the report concerned attackers misusing the two apps.

    “It is a dropper-type malware that installs proxyware of Peer2Profit and IPROYAL on the system as a user account without the user’s permission.”

    Supply and public reports High confidence Seen 23 Oct 2026 asec.ahnlab.com

26. GreyNoise reported an attacker who exploited edge-device flaws to install Pawns.app, which it called IPRoyal's "direct partner" and node supply chain, on at least 143 devices in 34 countries; it treated voluntary installs as legitimate and these as "proxyjacking".

    “Pawns.app appears to be a rebrand of “IPRoyal Pawns” and is owned by the same people.”

    Supply and public reports High confidence Seen 23 Oct 2026 greynoise.io

27. Proxyway's 2022 proxyware research said IPRoyal and PacketStream both rely on bandwidth sharers and supply proxies to other proxy providers; it named no buyers.

    “PacketStream and IPRoyal rely on bandwidth sharers. Their IP numbers aren’t that high, and both companies further resell proxies to other proxy providers.”

    Supply and public reports Medium confidence Seen 23 Oct 2026 proxyway.com

28. The same Trend Micro paper said a service it called SmartProxy was highly likely using infrastructure from proxyware and passive-income software, listing IPRoyal among them.

    “it is highly likely that SmartProxy is using the infrastructure provided by the following proxyware services and passive income software”

    Supply and public reports Low confidence Seen 23 Oct 2026 trendaisecurity.com

29. IPRoyal's Terms clause 5.5 said customers who do not select an IP risk level or buy the add-on may be given higher-risk IPs by default.

    “If no level is selected or the relevant add-on is not purchased, higher-risk IPs may be assigned by default.”

    Terms and price watch High confidence Seen 23 Oct 2026 iproyal.com

Includes information from AppEsteem’s Deceptor list as it stood on 23 Oct 2026, restated in our own words without changing its findings, and used under AppEsteem’s Terms of Use.