Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Space VPN - Free & Secure proxy

CRITICAL RISKRemoved from Chrome Web Store

Space VPN - Free & Secure proxy

ID: ippnncolkjbedlgpnlhdgblhbjobpklh

Could be malicious

Supported Languages

🇧🇷Brazilian Portuguese

🇧🇬Bulgarian

🇨🇳Chinese (Simplified)

🇹🇼Chinese (Traditional)

🇳🇱Dutch

🇺🇸English

🇵🇭Filipino

🇫🇮Finnish

🇫🇷French

🇩🇪German

🇮🇳Hindi

🇮🇩Indonesian

🇮🇹Italian

🇯🇵Japanese

🇰🇷Korean

🇱🇻Latvian

🇱🇹Lithuanian

🇳🇴Norwegian

🇵🇱Polish

🇵🇹Portuguese

🇷🇴Romanian

🇷🇺Russian

🇸🇰Slovak

🇸🇮Slovenian

🇪🇸Spanish

🇮🇳Tamil

🇹🇭Thai

🇹🇷Turkish

🇺🇦Ukrainian

🇺🇸US English

🇻🇳Vietnamese

Extension Info & Metadata

Status

Removed

Version

1.5.7

Size

1.53 MB

Rating

3.3/5

Reviews

Users

4,799

Type

Extension

Updated

Dec 21, 2021

Publisher Contextual Analysis

Author: spacevpn.devView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

4,799

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

100% free and secure VPN service for your browser! It has no time, location switching, speed limit at all.

🌍🌍🌍🌍🌍🌍🌍🌍🌍🌍🌍 SPACE VPN 🌍🌍🌍🌍🌍🌍🌍🌍🌍🌍🌍 🚀 Fly in the space of internet with Space VPN. Totally free VPN extension without any limits and with impressive bandwidth! Try it yourself and put 5 stars if all is ok! 🌌 VPN is a Virtual Private Network, a technology that allows you to browse the web without restrictions, protect your privacy, and encrypt your internet traffic by setting up a private, secure connection to a remote server. 🎑 Web browsing without any restriction absolutely secured and anonymously as well as unblock any website and receive all information from different sources as it should be in modern society. 🌠 Don’t forget to put 5 stars! 💶 Absolutely free! ⚡ No restrictions! 🧠 Easy interface! 🔑 Protected! 🟦 To install just click the button above. 📟 Connection: [email protected] 🌍🌍🌍🌍🌍🌍🌍🌍🌍🌍🌍 SPACE VPN 🌍🌍🌍🌍🌍🌍🌍🌍🌍🌍🌍

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

+28.18%(+1,055 users)

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 11 ratings

Average Rating

Current: 3.55 / 5.0-1.45

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical9

High3

Medium2

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.5.7 Code review	14

Extension Version	Code Review Findings
1.5.7	14

Files with findings

4 distinct paths — top paths by unique finding count:

js/background.js11
index.html1
js/popup.js1
js/utils.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	js/background.js (line 48)	The bgProcessor module intercepts every completed main-frame HTTP/HTTPS GET request and forwards the visited URL to a remotely-configured affiliate URL template (aff_url_tmpl fetched from the C2 server at unvpn.org). …	1.5.7
2	Data Exfiltration	critical	js/background.js (line 639)	The bgProcessor tracks complete redirect chains (rdr_chain) of all URLs visited and POSTs the full chain as a JSON array to a remotely-configured log_rdr_endpoint. This exfiltrates the user's entire browsing and redir…	1.5.7
3	Network Interception	critical	js/background.js (line 27)	The extension registers a blocking webRequest.onAuthRequired listener covering ALL HTTP and HTTPS URLs that automatically injects hardcoded proxy credentials into every HTTP authentication challenge encountered by the…	1.5.7
4	Network Interception	critical	js/background.js (line 83)	A blocking onBeforeSendHeaders listener manipulates request headers on all HTTP/HTTPS requests: it strips a remotely-configured header and injects its value into the Accept header, and forges the Referer header accord…	1.5.7
5	Network Interception	critical	js/background.js (line 151)	A blocking onHeadersReceived listener strips response headers whose names are listed in the remotely-controlled validateFields array (fetched from unvpn.org). This can be used to silently remove security headers such …	1.5.7
6	Other	critical	js/utils.js (line 74)	Proxy settings are configured via a dynamically-constructed PAC script that routes all non-whitelisted, non-local browser traffic through a proxy server whose IP, port, and protocol are fetched from https://unvpn.org/…	1.5.7
7	Remote Code Loading	critical	js/background.js (line 326)	The extension contacts a decoded C2 URL (https://tabs.vpnspace.poqdev.com/tabs) with the extension ID, version, unique user UID, and timestamp encoded as base64. The server response commands the extension to open acti…	1.5.7
8	Remote Code Loading	critical	js/background.js (line 378)	The extension fetches JSON configuration from https://api.vpnspace.poqdev.com/settings (URL decoded at runtime from an obfuscated string) and uses it to dynamically register a new blocking webRequest.onBeforeRequest l…	1.5.7
9	Unauthorized Data Collection	critical	js/background.js (line 484)	Every 15 minutes the extension beacons the user's unique ID (uid), install timestamp (mTime), cumulative usage time (lTime), and an opaque hash to https://unvpn.org/api/. The server response is merged wholesale into t…	1.5.7
10	Data Exfiltration	high	js/background.js (line 181)	The notifyAboutFail method POSTs URL and redirect-chain data (passed as the reason parameter) to a remote failure-reporting endpoint configured by the C2 server. This is invoked from constructDecodingInfoFunction when…	1.5.7
11	Network Interception	high	js/popup.js (line 9)	The popup renders server list data fetched from the background script, which ultimately originates from the remote C2 at https://unvpn.org/api/. The country_name values from the remote server are inserted directly as …	1.5.7
12	Obfuscation	high	js/background.js (line 711)	C2 endpoint URLs are encoded using a Caesar-cipher character shift and stored as obfuscated strings throughout the code, decoding at runtime to https://api.vpnspace.poqdev.com/settings and https://tabs.vpnspace.poqdev…	1.5.7
13	Code Injection	medium	index.html (line 62)	The loadLang() function replaces the entire document's innerHTML using a regex substitution over the raw HTML string, then reassigns document.documentElement.innerHTML. This destroys all existing event listeners attac…	1.5.7
14	Tracking	medium	js/background.js (line 656)	Install and uninstall tracking URLs are obfuscated with a Caesar cipher, decoding to https://vpnspace.poqdev.com/welcome.html and https://vpnspace.poqdev.com/goodbye.html. These are used to track exact install and uni…	1.5.7

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
chrome.google.com	/webstore/detail/	https://chrome.google.com/webstore/detail/
*	/*	http:///
*	/*	https:///
vpnstels.poqdev.com	/welcome.html	https://vpnstels.poqdev.com/welcome.html
vpnstels.poqdev.com	/goodbye.html	https://vpnstels.poqdev.com/goodbye.html
unvpn.org	/api/	https://unvpn.org/api/?
www.2ip.ru	-	https://www.2ip.ru/
api.vpn.com	/fail	https://api.vpn.com/fail
google.com	-	https://google.com

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


127.0.0.0	IPv4	-
255.255.255.0	IPv4	-
172.16.0.0	IPv4	-
255.240.0.0	IPv4	-
192.168.0.0	IPv4	-
255.255.0.0	IPv4	-
10.0.0.0	IPv4	-
255.0.0.0	IPv4	-

2.2 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

چرت

بهمن·12 Apr 2023

no working.

Ananstracated·25 May 2022

一个个都NBHH地挤掉正在用的，然后连地址列表都加载不出就好意思写connected。

Croowd Waterfield·19 Apr 2022

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Space VPN - Free & Secure proxy

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version14

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating