The investigation followed August 31 release of version 1.8.0, which introduced an alpha bot detection feature. Early production deployments supplied browser signals that helped researchers connect seemingly separate traffic sources.
Previously, CrowdSec’s detection focused mainly on IP behavior. Its Security Engine analyzes logs and HTTP requests, while its application security component supports browser challenges to filter automated traffic. These capabilities give defenders another way to inspect suspicious clients.docs.
Researchers cautioned that the observation period does not establish when PaperPhone began operating. The infrastructure likely existed before the new detection feature became available.
As deployments increased, more addresses became visible. Researchers also observed IP rotation as clients repeatedly failed challenges and encountered bans.
PaperPhone Network Fakes Mobiles
PaperPhone’s apparent international reach showed signs of centrally coordinated activity rather than independent users browsing from different locations.
Requests attributed to Japan peaked at 05:00 local time, while Indian traffic peaked at 01:00. Mexico and Lithuania showed peaks at 03:00 and 02:00, respectively.
More importantly, traffic spikes remained synchronized across distant regions. Japan and the United States showed highly correlated activity despite their time difference. Similar patterns appeared between Australia and Canada.
Researchers also found inconsistencies between address registration, ownership, and claimed location.
For example, 103.216.1.0/24 originated under APNIC allocation but was registered through RIPE following an interregional transfer. Its registrant was Lithuanian, while WHOIS listed the United States.
Nearby address ranges carried different geographic labels, including Brussels, Bangkok, Tokyo, and Paris. CrowdSec interpreted these patterns as evidence that the network’s geographic diversity was partly artificial.
Although the infrastructure spanned around 80 networks, a smaller group of entities controlled substantial portions of the address space.
M247 did not own the identified blocks, according to the supplied investigation. However, it provided transit for more than 20% of the cluster. That relationship alone does not establish operational responsibility.
Across thousands of addresses, PaperPhone clients consistently rotated through thirteen device identities, including Android devices and several iOS variants.
Despite those changing identities, every observed bot reported the same 375×812 viewport. This uniform rendering area conflicted with the variety of claimed devices.
Another indicator was the WebGL renderer, every client reported Google SwiftShader, a software renderer that uses the CPU rather than hardware graphics acceleration.
The claimed devices included recent models such as the Pixel 9 and Samsung Galaxy S25 Ultra. CrowdSec considered their shared software rendering behavior inconsistent with genuine mobile browsing.
Claims involving iOS 14 and 15 were also inconsistent with the reported rendering environment, further supporting the finding of spoofed identities.
Most participating ranges were already classified as data centers and recognized in CrowdSec’s threat intelligence.
The findings therefore describe a coordinated scraping network using hosting infrastructure, not a confirmed residential proxy campaign. Its operator and ultimate targets remain unidentified.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
