Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: SafeVPN - доступ к заблокированным сайтам!

CRITICAL RISKRemoved from Chrome Web Store

SafeVPN - доступ к заблокированным сайтам!

ID: opocaoaomipfgkogebbholnjcbbaionb

Could be malicious

Supported Languages

🇷🇺Russian

Extension Info & Metadata

Status

Removed

Version

4.69

Size

1.11 MB

Rating

3.0/5

Reviews

Users

6,113

Type

Extension

Updated

Dec 2, 2022

Publisher Contextual Analysis

Trusted

Author: beentoriedctView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

14,187

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

бесперебойный доступ к сайтам которые заблокированые!

Разблокируйте сайты, заблокированные в вашей стране, компании или школе, с помощью SafeVPN . SafeVPN - это бесплатный прокси-сервис VPN без рекламы, который обеспечивает более быстрый и более открытый Интернет. Разблокируйте сайты, заблокированные или подвергнутые цензуре в вашей стране, компании и школе, и транслируйте мультимедиа с помощью бесплатного прокси-сервера SafeVPN. Это не одноранговое приложение. Это расширение не ссылается и не поощряет загрузку каких-либо других продуктов и является полностью функциональным как есть, не требуя дополнительной загрузки. Если у вас есть какие-либо технические проблемы, пожалуйста, напишите нам по адресу [email protected] SafeVPN требует следующих разрешений: - Proxy: расширение SafeVPN проксирует ваш трафик через сервер в другой страна, чтобы изменить свой IP и разблокировать ограниченные сайты. - AllHosts / WebRequest / WebRequestBlocking: позволить расширению WinSafe проверять каждый веб-запрос и изменять его.. - Tabs: SafeVPN отслеживает ваши вкладки и включает VPN только на определенных вкладках и показывает всплывающее окно на странице, чтобы позволить вам включать, отключать и исправлять проблемы с подключением. - Cookies: SafeVPN получит доступ к вашим куки. Некоторые сайты кэшируют вашу страну в файлах cookie, и необходимо очистить их, прежде чем вы сможете получить доступ к этому сайту из другой страны. - Stroge: SafeVPN хранит локальную конфигурацию и данные кеша.

User Growth

Showing data from Nov 26, 2022 to Jun 12, 2023

Versions

-33.57%(-3,089 users)

Compared to 3 months ago

3 versions released in this period

Rating Count

Total: 1 ratings

Average Rating

Current: 3.00 / 5.0+3.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical5

High7

Medium1

Low1

Versions scanned

Showing 1 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
4.59 Code review	14

Extension Version	Code Review Findings
4.59	14

Files with findings

2 distinct paths — top paths by unique finding count:

js/bg.bundle.js13
pop.html1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	js/bg.bundle.js (line 18730)	The 'SafeVPN' background service worker bundles an entire third-party SDK that talks to `mallbery.com`, `analytics.savematik.com`, `pingapi.mallbery.com`, and `analytics.besttoolbars.net` — the Mallbery / BestToolbars…	4.59
2	Network Interception	critical	js/bg.bundle.js (line 23806)	The `iamb` (affiliate) module silently rewrites the user's tab to an attacker-controlled affiliate `baseClick` URL, attaching a partner ID (`cpId`) and the original URL as query params, whenever the navigated host mat…	4.59
3	Network Interception	critical	js/bg.bundle.js (line 20849)	Installs a declarativeNetRequest rule that blocks every request whose URL contains `t_tid=` or `t_s=` — tracking parameters used by competing affiliate networks (Awin/Tradedoubler/etc). This silently kills competitors…	4.59
4	Other	critical	js/bg.bundle.js (line 21004)	On merchant 'activation' the extension injects a script into the merchant page that wipes localStorage/sessionStorage entries (and then deletes cookies via chrome.cookies.remove on remembered merchant domains) belongi…	4.59
5	Remote Code Loading	critical	js/bg.bundle.js (line 22625)	Configuration object holding remote endpoints for three covert monetization modules (`iamb` affiliate-redirect bot, `ytAd` YouTube-ad injector, `uSearch` shopping-search hijacker). All endpoints, target-domain regex l…	4.59
6	Code Injection	high	js/bg.bundle.js (line 23899)	The `YTAd` module fetches a server-supplied list of videos with per-country/per-site frequency caps and exposes `ytAd-getVideos`, `ytAd-onStart`, `ytAd-onEnd`, `ytAd-onSkip`, `ytAd-onAdded` messages to a content scrip…	4.59
7	Credential Theft	high	js/bg.bundle.js (line 23291)	When the proxy is enabled the extension installs a declarativeNetRequest rule that injects the user's proxy `Basic` credentials as the `Authorization:` request header (not just `Proxy-Authorization`) on every main-f…	4.59
8	Data Exfiltration	high	js/bg.bundle.js (line 21392)	Every VPN-activity event is POSTed in the clear to `analytics.besttoolbars.net/api/v1/activity/vpn` — a third-party server unrelated to the stated 'SafeVPN' brand. Browsing/VPN-usage analytics being exfiltrated to an …	4.59
9	Remote Code Loading	high	js/bg.bundle.js (line 23655)	`scriptDomains` matches the current URL against a remote regex list (`config.scriptsDomains`, populated from `/v2/extension/settings`'s `sdData`) and emits `content.openScriptDomain` to a content script with the match…	4.59
10	Tracking	high	js/bg.bundle.js (line 23691)	`uSearch` matches the active tab against a server-supplied domain regex list (typically Google/Yandex/Bing search-result pages), then sends the user's search query and the result hosts to the operator's API to receive…	4.59
11	Unauthorized Data Collection	high	js/bg.bundle.js (line 21284)	On install (and again from `toggleGa`) the extension calls `chrome.management.getAll`, extracts the IDs of every other extension installed in the user's browser, and exfiltrates the list to its analytics endpoint. The…	4.59
12	Unauthorized Data Collection	high	js/bg.bundle.js (line 23385)	The `yandexMarket` module scrapes product model IDs viewed on Yandex Market pages, POSTs them to `/extension/ym/product` on the operator's server, then renders an attacker-supplied HTML `template` as an in-page notifi…	4.59
13	Tracking	medium	js/bg.bundle.js (line 24099)	On unload the extension navigates the user to `safevpn-vpn.ru/api/extension/uninstall?id=<install_hash>` — a per-install identifier that lets the operator track which specific browser/install was uninstalled. The hash…	4.59
14	Obfuscation	low	pop.html (line 1)	`pop.html` has been deliberately mangled with random whitespace and broken-up tag delimiters (`<` and `html` separated by newlines and spaces). Browsers tolerate this but it makes static review harder and is not a nor…	4.59

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
fonts.googleapis.com	/css2	https://fonts.googleapis.com/css2?family=Lato:wght@300;400;500;700;900&display=swap
fontello.commaterial	-	http://fontello.comMaterial
www.w3.org	/Graphics/SVG/1.1/DTD/svg11.dtd	http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd
lodash.com	-	https://lodash.com/
js.foundation	-	https://js.foundation/
lodash.com	/license	https://lodash.com/license
underscorejs.org	/LICENSE	http://underscorejs.org/LICENSE
npms.io	/search	https://npms.io/search?q=ponyfill.

Showing 1 to 10 of 40 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


26.141.185.3	IPv4	-
3.135.246.134	IPv4	-
2.1.218.176	IPv4	-
158.131.243.243	IPv4	-

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

SafeVPN - доступ к заблокированным сайтам!

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 3 Versions14

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating