PaperPhone Network Operates 75,000 IPs and Fake Mobile Profiles Across 43 Countries

A recently exposed operation named PaperPhone is leveraging a pool of 75,000 IP addresses together with forged mobile identities to make automated web traffic appear as ordinary smartphone activity. Researchers say the infrastructure spans 43 nations, giving the impression that traffic originates from a wide array of genuine users rather than a single bot farm.

The platform employs headless browsers—software capable of loading and interacting with web pages without a visual interface—and supplements them with bogus phone numbers, device IDs and other mobile‑specific metadata. By cycling through thousands of IPs and continuously altering the simulated device profile, PaperPhone sidesteps many detection methods used by sites and anti‑fraud solutions.

Analysts point out that the design is intentionally distributed. Instead of routing requests through a few data centers, the operators spread traffic across a global mesh of proxies, cloud instances and compromised devices. This dispersion both conceals the true source of the requests and makes it harder to block the activity without affecting legitimate users in the same regions.

Cybersecurity specialists warn that the same technology could be turned to a variety of illicit purposes, from ad fraud and credential stuffing to massive scraping of proprietary data. By emulating real mobile browsers—including plausible GPS locations, carrier details and OS versions—PaperPhone blurs the line between authentic customers and automated agents.

The revelation fits into a larger pattern of increasingly sophisticated bot networks that merge automation with realistic user footprints. As advertisers and online platforms tighten verification, threat actors respond with more elaborate identity spoofing, often using publicly available device fingerprints and open‑source tools.

Although the precise motives behind PaperPhone are still uncertain, its scale hints at a commercial driver, possibly tied to performance‑marketing schemes that reward large numbers of ad impressions or clicks. Researchers continue to watch the network for coordinated campaigns and advise organizations to adopt layered defenses such as behavioral analytics, device attestation and stricter rate‑limiting for mobile endpoints.

The findings were initially disclosed by cybersecuritynews, sparking calls for broader industry cooperation to share threat intelligence on such distributed headless‑browser networks. As the distinction between legitimate mobile traffic and automated requests grows fuzzier, stakeholders are encouraged to stay alert and refresh their detection tactics accordingly.