VPN for Discord

AI Security Review

Evidence context: threat category proxyware; evidence quality moderate.

The extension "VPN for Discord" (v0.0.4) is published under a generic Gmail address ([email protected]) with no identifiable company behind it, installed by approximately 10,000 users. The evidence reveals several concrete risk factors.

First, the extension contains three obfuscation findings alongside three network findings. The combination of obfuscation with network activity in a free VPN extension from an anonymous publisher is a recognized risk pattern — it obscures what data the extension actually transmits and to where. The network finding connects to https://welcome.cloudsearch.workers.dev/, a Cloudflare Workers subdomain, which is a common infrastructure choice for proxyware operations because it provides free, disposable, and hard-to-trace hosting.

Second, and most concretely, the extension contains Chrome Web Store URLs for another extension ("youtube-to-text") with UTM tracking parameters utm_source=extads&utm_medium=vpp_for_discord&utm_campaign=banner_[2-4]. This means the VPN extension is injecting advertisements for a different extension — a clear sign of ad injection or cross-promotional adware behavior. The three separate banner campaign IDs (banner_2, banner_3, banner_4) indicate systematic ad injection rather than an incidental link.

Third, the extension's uninstall URL points to https://ext.aitools.band/free-vpn/uninstall, a third-party domain rather than using Chrome's built-in uninstall feedback. This domain (aitools.band) collects data about user behavior at uninstall time, adding another data collection touchpoint outside the Chrome ecosystem.

The 162 IoC findings are almost entirely XIOC extractor false positives — fragments like offset.top, parentoffset.top, rect.top, curoffset.top are JavaScript property access chains misread as domains. The standard reference URLs (inkscape.org namespaces, creativecommons.org, whatwg.org) are legitimate web specification references embedded in code.

The strongest counterargument is that this could be a legitimate free VPN ad-supported extension, and the obfuscation could be routine code minification. However, minified code does not trigger dedicated obfuscation YARA rules, and legitimate VPNs from identifiable companies (NordVPN, ExpressVPN, Windscribe) do not inject ads for third-party extensions into unrelated web pages. The combination of anonymous publisher, obfuscation, ad injection to other extensions, and an opaque Cloudflare Workers backend crosses the threshold from "untrustworthy" to actively risky.

Users should be aware this extension likely monetizes traffic in addition to — or instead of — providing VPN services.

Key Reasons

• Ad injection URLs systematically promoting a third-party Chrome extension with tracking parameters
• Obfuscated code combined with network requests to an opaque Cloudflare Workers domain
• Anonymous publisher (generic Gmail) with no identifiable VPN company behind the extension
• Custom uninstall tracking URL on a third-party domain instead of Chrome native feedback

False Positive Considerations

• 162 of 168 findings are IoC false positives from JavaScript property access chains misread as domains
• Standard web specification reference URLs (inkscape.org, creativecommons.org, whatwg.org) flagged as IoCs

Reviewed 2026-05-30; recommended action: escalate; model confidence 78%.