PaperPhone Network Deploys 75,000 IPs and Synthetic Mobile Profiles Across 43 Nations

A newly uncovered operation called PaperPhone is harnessing a massive pool of 75,000 IP addresses and fabricated mobile identities to disguise automated web traffic as ordinary smartphone usage. Security researchers say the network spans 43 countries, making its activity appear as if it originates from a diverse set of real users rather than a single bot farm.

The system relies on headless browsers—software that can load and interact with web pages without a graphical interface—but augments them with counterfeit phone numbers, device identifiers, and other mobile-specific metadata. By rotating through thousands of IPs and constantly changing the simulated device profile, PaperPhone can evade many of the detection mechanisms that websites and anti-fraud tools typically employ.

Analysts note that the network’s architecture is deliberately decentralized. Instead of funneling requests through a handful of data centers, the operators distribute traffic across a global web of proxies, cloud instances, and compromised devices. This diffusion not only masks the true origin of the requests but also complicates efforts to block the activity without disrupting legitimate users in the same regions.

Cybersecurity experts warn that the technology could be repurposed for a range of malicious activities, from ad fraud and credential stuffing to large‑scale scraping of proprietary data. By mimicking the behavior of real mobile browsers—complete with plausible GPS coordinates, carrier information, and OS versions—PaperPhone makes it harder for platforms to differentiate between genuine customers and automated agents.

The discovery follows a broader trend of increasingly sophisticated bot infrastructures that blend automation with realistic user footprints. As advertisers and online services tighten their verification processes, threat actors are responding with more elaborate identity spoofing, often leveraging publicly available device fingerprints and open‑source tools.

While the exact motivations behind PaperPhone remain unclear, its scale suggests a commercial incentive, possibly linked to performance‑marketing schemes that reward high volumes of ad impressions or clicks. Researchers are monitoring the network for signs of coordinated campaigns, and they recommend that organizations adopt multi‑layered defenses, including behavioral analytics, device‑level attestation, and stricter rate‑limiting for mobile endpoints.

The findings were first reported by cybersecuritynews, prompting calls for broader industry collaboration to share threat intelligence about such distributed headless‑browser networks. As the line between legitimate mobile traffic and automated requests continues to blur, stakeholders are urged to stay vigilant and update detection strategies accordingly.