Loading threat actor…
IPCola is a proxy network built from compromised devices and marketed as a large residential-style IP service. It has been advertised as providing more than 1.6 million unique IP addresses spanning IoT, desktop, and mobile devices across more than 100 countries. Reporting links the operation to the GaGaNode SDK, which enables remote code execution on enrolled devices, indicating that the network is sustained through unauthorized control of victim systems rather than legitimate opt-in proxy sharing. The operation has been associated with a Chinese company, NuoChen, and a Chinese-language counterpart referred to as InstaIP. IPCola functions as criminal proxy infrastructure that can support anonymization, traffic relaying, and follow-on malicious activity through globally distributed infected endpoints.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.