Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: DoesVPN

CRITICAL RISKRemoved from Chrome Web Store

DoesVPN

ID: fkknekmhakikojnelmeknfijlnafogbd

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

3.0.3

Size

0.51 MB

Rating

5.0/5

Reviews

Users

4,000

Type

Extension

Updated

Jan 6, 2022

Publisher Contextual Analysis

Author: lesterbarry884View Profile
MX records exist: No
Domain exists: No
Is disposable: No
Is role-based: Yes
Mailbox exists: No

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

4,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Presenting the DoesVPN FREE Chrome extension: Download the best VPN browser extension for Google Chrome and get unlimited…

Presenting the DoesVPN FREE Chrome extension: Download the best VPN browser extension for Google Chrome and get unlimited bandwidth, fast connection speeds, total leak protection and protect your online activities. The DoesVPN free browser extension uses strong encryption to secure all your traffic and hides your real IP address so you can access any blocked website, protect your data and surf the internet anonymously without a data limit. The DoesVPN is the easiest way to stay secure and private online. Our virtual private network allows you to hide your IP address and access blocked content online from the moment you connect to our VPN servers. Connect to our secure servers from all over the world to experience an unlimited free VPN, and access websites, streaming content, and more. Get our VPN proxy extension for Google Chrome, experience unlimited bandwidth, and stay protected even when you're using public Wi-Fi and get total anonymous browsing. We have our own ad filter lists, so we also remove ads on YouTube and other popular search engines. Enjoy the internet comfortable! ~~ Disclaimer ~~ We cannot guarantee that our VPN service will work in China, Iran & Saudi Arabia. Even if you can download the application, we strongly recommend that you do not purchase Premium VPN accounts. We are not responsible for a lack of service and are not able to provide refunds for those countries. ~~ Protection Guaranteed ~~ As a Israel VPN company, we are bound by strict data privacy laws and do not track any IP or connection data. Мut we collect peer-to-peer domain data to redistribute load balancers so that users don't have low bandwidth. Access the internet with our VPN and stay safe. We have nothing to hide! Find out more here: http://www.doesvpn.digital/site/pages/privacy_policy ~~ ♥ Keep in touch! ~~ Visit site to learn more and get our latest VPN updates and news: → http://www.doesvpn.digital/

User Growth

Showing data from Jan 01, 2022 to Jan 16, 2022

Versions

No change in user count

Compared to 15 days ago

3 versions released in this period

Rating Count

Total: 1 ratings+1 (0%)

Average Rating

Current: 5.00 / 5.0+5.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High4

Medium1

Low0

Versions scanned

Showing 1 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
3.0.1 Code review	7

Extension Version	Code Review Findings
3.0.1	7

Files with findings

2 distinct paths — top paths by unique finding count:

background.js5
static/content/content.js2

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	static/content/content.js (line 109)	The content script runs at document_start on all Google search pages globally and silently redirects the browser to the extension's backend server (api.rdr-main.digital) with the full search query, user UUID, feed ID,…	3.0.1
2	Data Exfiltration	critical	background.js (line 1311)	On a recurring alarm (POST_UPDATE), the accumulated browsing history ('bh' array of domain hostnames) is serialized as a semicolon-separated string and POSTed to the extension's backend server (api.rdr-main.digital) t…	3.0.1
3	Other	high	background.js (line 1297)	Before sending the browsing history payload, the extension checks all open windows for devtools panels. If DevTools are detected it fires an 'invalid_data' message that deletes the 'bh' collection and increments a 'wa…	3.0.1
4	Other	high	static/content/content.js (line 32)	The content script checks a remotely-controlled 'ext_status' flag stored locally: if the value is 'b' (blocked), the search-hijacking execution is skipped. The backend server can toggle this kill switch via the update…	3.0.1
5	Tracking	high	background.js (line 1157)	The analytics function constructs a tracking beacon to the /feedp endpoint on api.rdr-main.digital that includes the full tab URL (u: tab.url) alongside the user UUID and extension identifiers. Combined with broad hos…	3.0.1
6	Unauthorized Data Collection	high	background.js (line 1530)	On every tab navigation completion, the background service worker silently accumulates visited domain hostnames into a local 'bh' (browsing history) array in chrome.storage. The extension has broad host permissions (*…	3.0.1
7	Unauthorized Data Collection	medium	background.js (line 8)	The extension backend domain 'api.rdr-main.digital' is unrelated to any legitimate VPN service and hosts install, uninstall, ping, and browsing-data collection endpoints. The extension also fetches server lists from b…	3.0.1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

119

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


browsec.com	/api/v1/	https://browsec.com/api/v1/
ip-api.com	/json	http://ip-api.com/json
www.google.com	/favicon.ico	http://www.google.com/favicon.ico
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
www.youtube.com	/*	https://www.youtube.com/*
www.google.com	/search*	https://www.google.com/search*
www.google.at	/search*	https://www.google.at/search*
www.google.be	/search*	https://www.google.be/search*
www.google.ca	/search*	https://www.google.ca/search*
www.google.ch	/search*	https://www.google.ch/search*

Showing 1 to 10 of 120 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


127.0.0.0	IPv4	-
10.0.0.0	IPv4	-
172.16.0.0	IPv4	-
192.168.0.0	IPv4	-

5.0 out of 5 · 1 most recent review

Text reviews

Positive

Negative

Awesome

Soul Gaming·8 Jan 2022

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

DoesVPN

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 3 Versions7

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating