Chrome Web StoreCaution required
Suspicious in code review
Our reviewer found behaviour consistent with malware, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
1 high-severity finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
Vpn Наоборот - Работает в рф 2026 is rated caution by Extension Auditor. Our code review reported 2 findings (1 high, 1 medium), led by network interception. It comes from a publisher with 7 extensions and was last updated in July 2026.
Key findings
- High
Network Interception
When enabled, all non-local browser traffic is routed through [domain withheld] (:10, port 443, bypassList only ["<local>"] at:24-28). Because the proxy sees CONNECT targets, its operator obtains the full list of hostnames and timing for every site the user visits, and can read and modify any plain-HTTP traffic; the extension cannot install a CA, so HTTPS payloads stay protected. The CWS listing declares no data collection at all and the privacy policy is a throwaway [domain withheld] page unrelated to the proxy domain, so this browsing-activity flow is undisclosed even though the destination is first-party.
- Medium
Other
The store listing is built entirely on a claim of selective routing — protection activates "только на тех сайтах, которые вы сами выберете", with online banking and local services explicitly promised to run direct. The implementation contradicts this: bypassList contains only "<local>", mode is "fixed_servers" (:28), and contains no site-selection UI of any kind, only an on/off dial and a premium upsell. Users are therefore told their banking traffic bypasses the proxy when in fact it is tunnelled through the operator's host.
Analyst notes
The code is a small, unobfuscated MV3 proxy toggle::24-49 sets chrome.proxy to fixed_servers pointing at [domain withheld] (first-party, matching PREMIUM_LINK [domain withheld]), with bypassList only ["<local>"], and is pure There is no remote config fetch, no remote code loading, no obfuscation and no exfiltration channel other than the proxy itself, and every ML regex hit is benign (js_innerhtml:1 is `premiumList.innerHTML = ""` at:107, html_img_tags:1 is the flag <img> at:30); chrome-stats' "permission-clipboard" reason is contradicted by both the bundled and published manifests, which declare only proxy and storage, and the two manifests otherwise match exactly. What keeps this out of benign territory is code-grounded, not score-grounded: the listing promises selective per-site routing with banking and local services going direct, while the code routes all non-local traffic through an anonymous.space host with no per-site UI anywhere, and the CWS disclosures declare no data collection even though the proxy operator necessarily receives every hostname visited (the publisher's malicious record, the 38% permhash cluster and the imported malext feed note are context only, and the feed entry itself states it is not a code review).
Vpn Наоборот - Работает в рф 2026 Chrome extension security report
ID: njapjlocglmmlikpjompjpbnldgaaaan
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- ihocociqu52@gmail.com
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Screenshots & videos
Install growth
- 1 high
- 1 medium
The file, code excerpt and explanation behind each finding are part of the full report. No conclusion has been withheld — only the evidence. The verdict above already reflects everything found here.
1 high-severity finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
VPN Наоборот — работает в РФ 2026. Быстрый доступ к сайтам, YouTube и Telegram в браузере.
Read the publisher’s full description
Переверните представление о цифровой безопасности! VPN наоборот — это инновационное и легкое расширение для Google Chrome, созданное для тех, кто ценит умный подход к конфиденциальности, максимальную скорость и комфорт. В отличие от обычных сервисов, которые шифруют весь трафик подряд и замедляют браузер, «VPN наоборот» работает точечно. Он активирует защищенное соединение и маскирует IP-адрес только на тех сайтах, которые вы сами выберете. Весь остальной интернет работает напрямую на максимальной скорости вашего провайдера. Почему пользователи выбирают VPN наоборот? Умная избирательность: Защита включается автоматически только там, где она действительно нужна. Локальные сервисы без сбоев: Ваши привычные приложения, доставка еды и онлайн-банкинг больше не будут блокировать вас из-за «иностранного IP». Космическая скорость: Больше никакого падения скорости на обычных сайтах — расширение не тратит ресурсы системы впустую. Надежное шифрование данных: Полная конфиденциальность и маскировка цифрового следа на выбранных веб-ресурсах. Управление в 1 клик: Простой и интуитивно понятный интерфейс, в котором разберется каждый. Сделайте свой интернет-сёрфинг по-настоящему умным. Установите VPN наоборот прямо сейчас!
User reviews
Extension files
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
1 high-severity finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Gain full insight into all external connections.
Upgrade for full visibility.
Related extensions
More from ihocociqu52@gmail.com
Popular in Privacy & Security
- McAfee® WebAdvisor162,000,000 users
- uBlock Origin Lite21,000,000 users
- Imprivata Enterprise Access Management20,000,000 users
- Kaspersky Protection19,000,000 users
- VPN for Chrome: NordVPN proxy protection15,000,000 users