What our analysis found

VPN Proxy бесплатный - Troywell ВПН для Chrome is rated caution by Extension Auditor. Our code review reported 2 findings (1 critical, 1 high), led by network interception. It comes from a publisher with 17 extensions and was last updated in July 2026.

Key findings

• critical· network interception —All non-local browser traffic is routed to ` ` (:10), a host on AEZA GROUP LLC infrastructure (, St. Petersburg RU operator) that bears no relation to the "Troywell" brand in the listing or to any disclosed operator. The proxy operator can observe every domain the user visits and traffic, yet the CWS listing declares no data collection at all and the only privacy policy is an anonymous page, so the user has no way to know who receives their full browsing stream.
• high· phishing —The extension brands itself as "Troywell ВПН" with a `troywell-gold` theme, impersonating the established Troywell VPN service (, ~1.5M users), while the actual proxy and the paid-upgrade landing page both sit on the unrelated ` `. The same publisher's account-level privacy policy is written for yet another borrowed brand ("1click VPN"), and:1 plus the templating note at:335-337 show this is one reskin of a multi-brand template, so the borrowed name is what persuades users to hand their traffic to an anonymous operator and to click through to its payment funnel (:103-124 opens that landing automatically on install).

The code is tiny and fully readable with no exfiltration primitives, but its single function is to point `chrome.proxy.settings.set` at ` ` with `bypassList: ["<local>"]` (:10,:24-36), routing 100% of the user's non-local browsing through one host. That host resolves to, netname `aeza-net-de`, org AEZA GROUP LLC (St. Petersburg, RU), and has no relationship to "Troywell", which is an established VPN brand at whose own Chrome extensions are published under a different developer; this listing is published by a Gmail address (reshilipogolove@) whose publisher-level privacy policy is for a *different* borrowed brand ("1click VPN"), and:1 and the mojibake template note at:335-337 ("copy this Premium CTA to the end of of every theme") show a reskinnable clone-farm template. The permhash cluster ( flagged) and the publisher's malicious siblings corroborate; the bundled and published manifests match, and chrome-stats contradicts itself by citing a `clipboard` permission that is absent from the manifest, so its score carries little weight here.