Chrome Web Store

Troywell VPN Pro - High-speed and safe VPN

by [email protected] · 30.0K users · 2.3 rating
b700e558-c64a-547a-9f05-ff512fefa504 | v4.2.10
65/ 100
MEDIUM risk
-4 since v4.2.9
Analyst verdict
Confirmed risk

From the RiskyPlugins AI security review of the observed evidence.

Analysis record

Analysed
1 months ago
Version
v4.2.10
Artifact
SHA256 4D6…90E
Source
Findings (non-IoC)

Evidence ledger

Ranked by severity · findings with a source location link to the code viewer

52 detail rows

YARA Rule Matches

13 rules
SeverityRuleHitsFilesMetadata
LOWpostinstall persistence mechanism 6
fonts/Gilroy-Regular.ttffonts/Gilroy-Bold.ttffonts/Gilroy-Medium.ttf +3 more
-
LOWNoUseEval 1
popup/bundle.js
-
LOWpostinstall file download 4
agreement/bundle.jspopup/bundle.jspopup/styles.css +1 more
-
LOWSQLInjection 1
bg/bundle.js
-
LOWNoUseWeakRandom 3
agreement/bundle.jspopup/bundle.jsbg/bundle.js
-
LOWpostinstall crypto operations 4
agreement/styles.csspopup/styles.css_metadata/verified_contents.json +1 more
-
LOWOriginsNotVerified 3
bg/bundle.jsagreement/bundle.jspopup/bundle.js
-
LOWpostinstall file manipulation 5
agreement/styles.cssagreement/bundle.jspopup/bundle.js +2 more
-
LOWpostinstall system command 5
popup/bundle.jsagreement/styles.cssagreement/bundle.js +2 more
-
LOWpostinstall registry modification 3
popup/bundle.jsbg/bundle.jsagreement/bundle.js
-
LOWpostinstall obfuscation 5
agreement/styles.cssagreement/bundle.jspopup/bundle.js +2 more
-
LOWpostinstall network communication 6
agreement/styles.cssagreement/bundle.jspopup/bundle.js +3 more
-
LOWLocalStorageShouldNotBeUsed 2
agreement/bundle.jspopup/bundle.js
-

Publisher Evidence

Limited evidence

[email protected]

Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.

Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.

39
Noisy-finding weight
x1.00
Publisher domain
No domain
Missing
Store verification signal
Limited signal
Limited
Extension portfolio
3
Portfolio

11 evidence rows available.

Finding Categories

3
Obfuscation
187
IoC Indicators

YARA Rules Matched

13 rules(48 hits)
postinstall persistence mechanism NoUseEval postinstall file download SQLInjection NoUseWeakRandom postinstall crypto operations OriginsNotVerified postinstall file manipulation postinstall system command postinstall registry modification postinstall obfuscation postinstall network communication LocalStorageShouldNotBeUsed

Requested Permissions

17 permissions
management

Manage other installed extensions

Dangerous
proxy

Control the browser's proxy settings

Dangerous
<all_urls>

Access and modify data on every website you visit

Dangerous
webRequest

Intercept, modify, and block all network requests

High
cookies

Read and modify cookies on all sites

High
tabs
Medium
webRequestAuthProvider
Low
webNavigation
Low
storage
Low
alarms
Low
unlimitedStorage
Low
notifications
Low
privacy
Low
scripting
Low
declarativeNetRequest
Low
declarativeNetRequestWithHostAccess
Low
declarativeNetRequestFeedback
Low

AI Security Report

AI Security Review

Evidence context: threat category proxyware; evidence quality moderate.

The Troywell VPN Pro extension presents significant risk indicators despite lacking traditional malware signatures. The extension is published by an anonymous Gmail address ([email protected]) rather than a verified company or known VPN provider. This is a critical red flag for VPN extensions, which should be operated by identifiable organizations with privacy policies and security audits.

The extension contacts 11 suspicious domains that are inconsistent with legitimate VPN functionality. Domains like t.state.page, t.state.online, and t.state.analytics suggest state tracking infrastructure. The geolocation domains n.geocodeinfo.city, n.geocodeinfo.country, and location.city indicate the extension is collecting location data from users. Additional domains including locations.best, this.store, and rail-x.ps appear to be marketing or monetization endpoints. A legitimate VPN should not need to contact geolocation services or state tracking domains—these are characteristic of proxyware that routes user traffic through third-party infrastructure while harvesting browsing and location data.

The manifest.json declares the 'tabs' permission, which is standard for VPN extensions but becomes concerning when combined with anonymous publishing and suspicious domain contacts. This permission allows the extension to read browsing history and page content, which could be exfiltrated to the identified domains.

The 63 code-smell findings are typical false positives from broad YARA rules matching basic Node.js patterns (fetch, exec, crypto). No malware signatures, obfuscation, or secret findings were detected. However, the absence of malware signatures does not indicate safety—proxyware and data exfiltration tools often operate without triggering traditional malware detectors.

Counterargument: A skeptic might argue that 948 IoCs without malware signatures indicates false positive noise from the XIOC extractor, and that VPN extensions naturally contact many domains for server routing. This argument is incorrect because the specific domains identified (geocodeinfo.city, t.state.*, locations.best) are not legitimate VPN infrastructure domains. Legitimate VPNs from known companies contact their own server endpoints, not third-party geolocation and state tracking services. The domain names themselves reveal data collection intent rather than VPN functionality. The anonymous Gmail publisher further confirms this is not a legitimate VPN service.

This extension exhibits the classic proxyware profile: anonymous publisher, VPN category claim, and contacts to geolocation/tracking domains rather than legitimate VPN infrastructure.

Key Reasons

  • Anonymous Gmail publisher for VPN extension
  • Suspicious geolocation domains (n.geocodeinfo.city, location.city)
  • State tracking domains (t.state.page, t.state.online, t.state.analytics)
  • VPN category without identifiable company
  • Tabs permission combined with data collection infrastructure

False Positive Considerations

  • code-smell findings from broad YARA rules
  • high IoC count from XIOC volume

Reviewed 2026-05-23; recommended action: escalate; model confidence 82%.

Chrome version history

Risk trend by version

2 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.

Selected
65
Change since first
-4
Change from previous
-4
Versions:
First analyzed version
4.2.9
Jul 4, 2026
Risk range
65 to 69
Across analyzed versions
Latest analyzed version
4.2.10
Sep 15, 2026
Selected version
medium
Version
v4.2.10
1 months ago
Risk score
65
Findings
240
Change vs previous
-4

Pick any point on the chart to explore that version's code below.

About This Extension

Troywell VPN Pro - Fast and secure VPN High speed and secure connection. Getting access to all sites has become easier with the PRO version. What is an extension? This is a special program for a specific browser, the need for which arises when it is necessary to hide or protect the established connection. It is also needed in the case of encrypting personal information (last name, first name, bank card details, logins, passwords, and so on) and hiding data of any session. This program is not difficult to install from this site, even a novice can cope with the task. What benefits do you get from its use: The feasibility of installing a VPN extension Troywell is a small application designed to significantly increase the capabilities of your browser. Usually, such software products are free and their installation is not difficult. In addition, they are compatible with any operating system. VPN is used from blocking Internet resources within a certain territory, placing orders over the Internet or sending files that contain important information over the network. In this case, Troywell VPN PRO is designed for some other tasks: provides complete privacy when browsing the Internet resource - your IP address will remain unknown; - provides access to virtually any resource - in the case of blocking the site, to remove its recommended VPN download; - maintains a stable connection - usually these plugins are provided with a large number of servers to maintain the quality of connection; - guarantees a completely secure connection - all personal information of the user will be protected from unauthorized access; - hides client traffic - VPN for Google Chrome changes the user's IP to a server address, and it is impossible to identify the person's real location; - maintains a secure connection to Wi-Fi network - when the user often uses Wi-Fi network in some public places, it makes sense to use VPN to protect personal information; - encrypts any information - not only personal data of the client will be protected, but also the traces of the search history in the internet browser will be deleted; - current location - automatically determines the current location of the user; - speed test - defines the real speed of the Internet, which is provided by your provider or mobile operator. Thus, the advantages of installing a VPN on Chrome are numerous. People who often browse blocked online resources, shop online, send important documents or want to secure their personal information have a particular need to activate this application. What benefits does Troywell VPN PRO have? The application has all the features listed above. However, these are not the most important ones. The most important features are the high-speed connection (compared to competitors' offers) and the absence of restrictions. Most services offer to purchase a paid subscription to work with all the features of the program, or allows you to use only a stripped-down functionality. VPN by Troywell is a completely free application without any restrictions in terms of the availability of features. How to download and install? Usually, the installation and activation process is easy and requires very little time. You can download the application in one click. To do this, you need to activate the "Install" button and confirm your action. This, in fact, is the whole procedure. After a short period of time, the application will be installed and appear on the control panel. After that, you can start working with it. How to operate Troywell VPN PRO after downloading? So, you have completed the installation of the extension, now it will not be difficult for you to understand its work. It's not for nothing that Troywell is the most promising free VPN for Chrome. The app also wins over the competition due to the fact that everything is elementary simple in terms of installation and management. The program icon is usually located on the control panel inside the Internet browser, it is also easy to remove if not needed. To start it, you need to click on the Troywell icon. A window will pop up, in which you need to click on the big activation button. Here everything is very simple, you can not mix up anything. Almost immediately, the VPN will begin functioning, and the client will be able to view even blocked in his country resources, encrypt personal data and hide the traces of Internet browsing history. In the box during the activation process displays your new IP address, depending on which server you are connected to. The window also shows the duration of the current session, amount of traffic used, statistics of the program's operation over a certain period of time, and the exclusion sites. In addition to the above, the program allows you to find out the location of the server with which you are connected at a given time interval. If the connection to this particular location does not suit you (for example, the server is located in a state where restrictions are imposed on the desired site), it is possible to cope with this. If the client has used our services and no longer sees the need for them, it is possible to disable it. Then click on the icon of the application and click "Disable VPN". The application will be deactivated, but will remain in the browser control panel. If the need arises, it can be restarted according to the same scheme as outlined in the block above. It is not advisable to remove the VPN at all, as you will most likely need it more than once. In conclusion. Troywell VPN PRO is one of the best products for Google Chrome. It makes it easy to change your IP address to evade blocking, encrypt your personal data, buy safely online, and much more. You get all of these features absolutely free and in one click. Very soon after you start, you will realize that this is the best version of the application with a set of relevant features. Similar offers lose to our extension in one way or another, because they do not have those or other features. So feel free to download Troywell VPN PRO and use its functionality without any limitations.

Frequently Asked Questions