CampaignPublished 10 Feb 2026Updated 12 Mar 2026

Silent Push Traffic Origin Data Combined with Residential Proxy Data Uncovers Suspicious Chinese VPN

Source AlienVault OTX General

Description

An investigation using Silent Push's Traffic Origin and residential proxy data revealed a suspicious Chinese VPN provider. The analysis focused on IP address 205.198.91.155, which showed unusual traffic from Russia, China, Myanmar, Iran, and Venezuela. This IP was linked to the domain lvcha.in, hosting a Chinese-language VPN. Further investigation uncovered nearly 50 related domains promoting the same VPN, suggesting attempts to bypass country-level firewalls. The VPN's infrastructure was found to use residential proxies and had connections to various high-risk countries. This case study demonstrates the importance of verifying physical and technical behaviors of connections to protect against fraud and state-sponsored actors using stolen identities and spoofed locations.

Impact

The primary impact of this threat lies in its potential to undermine geolocation-based security controls and network filtering mechanisms. Organizations relying on IP-based geofencing or country-level firewall rules may be deceived by the VPN's use of residential proxies and spoofed traffic origins, allowing threat actors to bypass restrictions and gain unauthorized access. This can facilitate fraud, data exfiltration, or reconnaissance by state-sponsored groups or cybercriminals. Additionally, the presence of multiple domains and proxy infrastructure increases the complexity of detection and mitigation efforts, potentially leading to prolonged exposure. While no direct malware or exploits are currently linked to this VPN, its infrastructure could be leveraged for future attacks, including command and control communication or lateral movement within networks. The threat also poses reputational risks for organizations if their networks are used as proxies or if they inadvertently allow malicious traffic. Overall, the impact is moderate but significant for entities with strict geolocation policies or those targeted by nation-state adversaries.

Defensive guidance

To mitigate this threat, organizations should implement advanced network traffic analysis capable of detecting anomalies associated with residential proxy usage and geolocation spoofing. This includes correlating IP reputation data with behavioral indicators and employing threat intelligence feeds that identify suspicious VPN domains and IPs. Network segmentation and strict access controls can limit exposure if unauthorized VPN traffic is detected. Deploying multi-factor authentication and continuous user behavior analytics helps reduce risks from compromised credentials or spoofed identities. Organizations should also regularly update firewall and proxy configurations to block known malicious IP ranges and domains linked to this VPN infrastructure. Collaboration with threat intelligence providers to receive timely updates on emerging proxy networks and suspicious VPN services is essential. Finally, educating security teams on the tactics used by state-sponsored actors to evade detection will improve incident response capabilities.

Indicators of compromise

Domains 49

catixs.com
lcabc.icu
lcapi.shop
lcapp.bar
lcapp.bond
lcapp.cfd
lcapp.cyou
lcapp.icu
lcapp.my
lcapp.qpon

IP addresses 3

194.147.16.244
205.198.91.136
205.198.91.155

Hashes 1

994dfe8573747f2b90e4d32b5ae07fc6

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 12 Mar 2026, 18:45 UTC

MITRE ATT&CK techniques5 from threat tags

Technical details

Indicators of compromise

Domains 49

IP addresses 3

Hashes 1

Community reviews

Related threats