PaperPhone Cluster Shows How One Bot Operator Can Look Like Thousands of Mobile Users
CrowdSec says the PaperPhone scraper used 75,000 IPs in 43 countries to impersonate mobile users.
CrowdSec analyzed PaperPhone, a scraping cluster that used roughly 75,000 IP addresses in 230 blocks across 43 countries to look like tens of thousands of mobile users. Request bursts were synchronized in UTC, including across regions many time zones apart, and registry, WHOIS, and geolocation records conflicted. Clients rotated 13 claimed Android and iOS identities, including Pixel 9 and Galaxy S25 Ultra, but all reported a 375 by 812 viewport and Google SwiftShader. M247 provided transit for more than 20 percent of the traffic. CrowdSec did not name the operator or targets and said most ranges were already known data-center infrastructure.
46