Lurking Lizard Runs 230+ Domains for Residential Proxy Botnet via Trojanized 7-Zip Installers Since 2022
Lurking Lizard built an end-to-end residential proxy business using trojanized 7-Zip and other installers across 230+ domains since 2022. Evidence from Infoblox and Proxyway links the actor to China and shows reuse of dismantled IPIDEA infrastructure. The model combines malware distribution with fake proxy storefronts and review sites.
The campaign recruits devices through expired domain drop-catching and typosquatting on names like 7zip[.]com. Malware beacons to IPLogger infrastructure also used for fake WhatsApp, TikTok downloader, and WireVPN installers across Windows, macOS, and Android. An Android app under WEILAI NETWORK TECHNOLOGY CO., LIMITED exceeded one million downloads while funneling traffic into the same proxy pool. Infoblox infrastructure fingerprinting and WHOIS data point to a China-based operator. Proxyway cross-referenced 773,087 SmartProxy IPs against a 16-million IP dataset from dismantled IPIDEA infrastructure, revealing direct reuse or resale patterns. The actor impersonates IP Royal, SmartProxy, and 911Proxy while operating fake review sites to monetize the botnet. This operation exposes a closed-loop criminal model: lure acquisition, proxy infrastructure management, and storefront marketing. It parallels malvertising affiliate schemes but targets bandwidth and IP reputation rather than ad fraud. Mobile apps may expand reach without confirmed proxy functionality yet. Next indicators will appear in new domain registrations and Google Play takedowns. Defenders should monitor for IPLogger URLs and expired-domain reuse in software distribution chains.
Infoblox: 40+ new Lurking Lizard domains registered within 120 days via continued drop-catching.
Sources (2)
- [1]Infoblox DNS Threat Intelligence Report(https://www.infoblox.com/resources/reports/)
- [2]Proxyway IP Dataset Analysis(https://proxyway.com/)