M247 (Organization): news timeline & CVEs

PaperPhone Headless Browser Network Uses 75,000 IPs and Fabricated Mobile Identities Across 43 Countries

CrowdSec says the PaperPhone headless-browser network scraped the web from 75,000 IPs across 43 countries.

CrowdSec’s September 29 report describes PaperPhone, a headless-browser network seen over two weeks using about 75,000 IP addresses in 230 blocks across 43 countries for large-scale web scraping. Traffic peaks from distant countries rose together, and many ranges were known data-center space rather than residential proxies; more than 20% transited via M247. Bots cycled 13 claimed Android and iOS identities but all reported a 375×812 viewport and exposed Google SwiftShader, consistent with unaccelerated Chrome automation. CrowdSec did not identify compromised servers, specific victims, stolen data, or financial losses.

Cyber Security News16:05 UTC · 5h agoThreat actor 2 sources

PaperPhone Cluster Shows How One Bot Operator Can Look Like Thousands of Mobile Users

CrowdSec says the PaperPhone scraper used 75,000 IPs in 43 countries to impersonate mobile users.

CrowdSec analyzed PaperPhone, a scraping cluster that used roughly 75,000 IP addresses in 230 blocks across 43 countries to look like tens of thousands of mobile users. Request bursts were synchronized in UTC, including across regions many time zones apart, and registry, WHOIS, and geolocation records conflicted. Clients rotated 13 claimed Android and iOS identities, including Pixel 9 and Galaxy S25 Ultra, but all reported a 375 by 812 viewport and Google SwiftShader. M247 provided transit for more than 20 percent of the traffic. CrowdSec did not name the operator or targets and said most ranges were already known data-center infrastructure.

GBHackersupdated 16:05 UTC · 5h agofirst 12:31 UTC · 9h agoResearch 2 sources

M247

Timeline2 articles

Appears with

PaperPhone Headless Browser Network Uses 75,000 IPs and Fabricated Mobile Identities Across 43 Countries

PaperPhone Cluster Shows How One Bot Operator Can Look Like Thousands of Mobile Users