Researcher Finds Bright Data SDK Can Turn Consumer Apps Into Web-Scraping Proxies

Jun 6, 2026 · Original article ↗

Summary

Include Security and researcher Buchodi say Bright Data’s SDK can route scraping through users’ home connections; iOS traffic may bypass VPNs and run in the background. Smart-TV exposure is suggested by platform and partner evidence, not confirmed for each app.

Key points

Reverse-engineering Bright Data’s iOS SDK, the researcher found it can relay web-scraping jobs through a device’s home internet connection.
The researcher reported that the peer channel lacks strong authentication controls; on iOS, traffic can bypass a configured VPN and evade common monitoring tools.
The SDK can continue relaying in the background, and its loaded settings allow up to 200 GB of traffic per month; the article says some countries have higher limits.
The article says the SDK’s actual traffic and runtime limits may exceed what an app’s opt-in screen describes.
Smart-TV exposure is supported by Bright Data platform support and a public partner list, but partner-list inclusion does not establish that an app currently contains the SDK.
The research says router-level blocking of SDK connection domains can stop relaying; mobile connections may bypass office Wi-Fi controls.
The article describes use of a home connection as proxy infrastructure, not evidence of a hacked account or stolen data.

Article Details

Attack Vectors: Bright Data’s SDK, embedded in consumer apps, connects to company servers that send instructions for devices to fetch pages from other websites through the user’s home internet connection.
The researcher found that the peer channel carrying scraping jobs lacks strong authentication controls.
On iOS, the SDK’s traffic can bypass a configured VPN and continue relaying in the background, including while the device is in use.
The opt-in wording in a Roku app, Petflix, described device and connection use as occasional, while SDK settings allowed up to 200 GB of traffic per month; limits were reported to be much higher in Uzbekistan and Oman.
The article says the smart-TV reach is supported by platform support, Bright Data’s public partner list, and earlier reporting; partner-list presence alone does not establish that an app currently includes the SDK.
Defensive Notes: Block the listed Bright Data SDK connection domains at the router; the article says this stops devices from acting as relays without affecting Bright Data’s paid service.
Organizations managing staff phones can scan for apps that contain the SDK.
A network block may not catch traffic on mobile connections, and the article notes that connection changes by Bright Data could require blocklists to be updated.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`clientsdk[.]brdtnet[.]com`	Bright Data SDK connection endpoint used for device relay behavior; the article recommends blocking it to stop relaying.
DOMAIN	`clientsdk[.]bright-sdk[.]com`	Bright Data SDK connection endpoint used for device relay behavior; the article recommends blocking it to stop relaying.
DOMAIN	`proxyjs[.]brdtnet[.]com`	Bright Data SDK connection endpoint used for device relay behavior; the article recommends blocking it to stop relaying.
DOMAIN	`proxyjs[.]bright-sdk[.]com`	Bright Data SDK connection endpoint used for device relay behavior; the article recommends blocking it to stop relaying.
DOMAIN	`proxyjs[.]luminatinet[.]com`	Bright Data SDK connection endpoint used for device relay behavior; the article recommends blocking it to stop relaying.