VPNtube - Ютуб без замедления

AI Security Review

Evidence context: threat category proxyware; evidence quality moderate.

This extension presents multiple risk indicators consistent with proxyware from an anonymous publisher. The extension claims to bypass video slowdowns, which requires proxy or traffic-routing functionality. The developer is listed only as '[email protected]' with no company attribution, matching the pattern of unverified VPN extensions that may route user traffic through third-party infrastructure.

The IoC findings reveal concerning domains: vlrash.myxavpn.com and flrash.myxavpn.com indicate proxy infrastructure, while telesco.pe is a domain associated with adware campaigns. The presence of popup/checkout.js with network calls at line 58 is particularly suspicious—a video playback extension has no legitimate reason to include checkout functionality, suggesting payment collection or monetization mechanisms. Network calls in js/bg.js at lines 96 and 215 use fetch to external endpoints, consistent with proxy control or data transmission.

Of the 329 IoC findings, many are known false positives: v.call and t.call are property access chains misidentified as domains, jquery.org is a legitimate CDN, and youtubekids.com is a Google product. However, the myxavpn.com subdomains and telesco.pe are specific, non-generic domains that warrant concern. The 55 code-smell findings are low-severity noise from the YARA rules and should not drive the verdict.

Counterargument consideration: A skeptic might argue this is a legitimate free VPN service, as many such extensions exist. However, legitimate VPN providers (NordVPN, ExpressVPN, etc.) identify their company and have transparent privacy policies. This extension's anonymous Gmail publisher, combined with checkout.js monetization code and adware-associated domains, distinguishes it from reputable providers. The extension routes traffic through unverified infrastructure (myxavpn.com) with no accountability.

Recommended action: Users should avoid installing this extension. The proxyware functionality combined with anonymous publication and suspicious monetization patterns create significant privacy and security risks, even without confirmed malware signatures.

Key Reasons

• Anonymous Gmail publisher with no company attribution for VPN/proxy extension
• Suspicious proxy infrastructure domains (vlrash.myxavpn.com, flrash.myxavpn.com)
• checkout.js file with network calls in video extension suggests monetization
• Domain telesco.pe associated with adware campaigns
• No malware signatures but proxyware behavior from unverified publisher

False Positive Considerations

• Property access chains misread as domains (v.call, t.call)
• Legitimate CDN domains (jquery.org)
• Code-smell findings from YARA rules (55 low-severity findings)
• High IoC count from bundled dependencies

Reviewed 2026-05-23; recommended action: monitor; model confidence 85%.