PaperPhone Botnet Mimics Tens of Thousands of Mobile Users Across 43 Nations

Security analysts have identified a massive web‑scraping network, dubbed PaperPhone, that can fabricate the presence of tens of thousands of legitimate‑looking mobile devices for a single operator. The cluster leverages an extensive pool of roughly 75,000 IP addresses, arranged in 230 distinct address blocks, and spans 43 countries, giving the illusion of a globally distributed user base.

The sheer scale of the IP infrastructure enables PaperPhone to scatter its traffic across continents, making each simulated device appear to originate from a different geographic region. By rotating through thousands of addresses, the botnet evades simple geo‑location checks and blends in with genuine mobile traffic, a tactic that can deceive advertisers, analytics platforms, and fraud detection tools.

Technical details suggest the operator runs automated scripts that replicate typical mobile behavior—such as app launches, clicks, and data requests—while masking the underlying automation. The operation does not rely on a large fleet of compromised phones; instead, a single controller orchestrates the appearance of many users by exploiting the distributed IP pool. This approach reduces the logistical burden of managing real devices and lowers the risk of detection.

Mobile‑centric fraud schemes have grown increasingly sophisticated in recent years, with botnets targeting ad impressions, affiliate payouts, and user‑profile harvesting. PaperPhone’s ability to generate a credible façade of millions of device identifiers amplifies the potential financial impact, as advertisers may pay for interactions that never involve real humans. The discovery adds to a pattern of large‑scale scraping efforts that have previously targeted social media, e‑commerce, and streaming services, highlighting a broader ecosystem of illicit automation.

Researchers who uncovered the cluster, originally reported by GBHackers, warn that platforms must strengthen fingerprinting and behavioral analytics to differentiate genuine mobile activity from scripted mimicry. Law‑enforcement agencies are also being alerted, as the cross‑border nature of the IP addresses complicates jurisdictional enforcement. Ongoing monitoring and collaborative threat‑intelligence sharing are expected to be key in mitigating the risks posed by operations like PaperPhone.