Troywell VPN Pro - High-speed and safe VPN
From the RiskyPlugins AI security review of the observed evidence.
Analysis record
- Analysed
- 1 months ago
- Version
- v4.2.10
- Artifact
- SHA256 4D6…90E
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
13 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| LOW | postinstall persistence mechanism | 6 | fonts/Gilroy-Regular.ttffonts/Gilroy-Bold.ttffonts/Gilroy-Medium.ttf +3 more | - |
| LOW | postinstall crypto operations | 4 | popup/bundle.js_metadata/verified_contents.jsonpopup/styles.css +1 more | - |
| LOW | OriginsNotVerified | 3 | agreement/bundle.jspopup/bundle.jsbg/bundle.js | - |
| LOW | postinstall file manipulation | 5 | popup/bundle.jspopup/styles.cssbg/bundle.js +2 more | - |
| LOW | postinstall system command | 5 | bg/bundle.jspopup/bundle.jspopup/styles.css +2 more | - |
| LOW | postinstall registry modification | 3 | bg/bundle.jsagreement/bundle.jspopup/bundle.js | - |
| LOW | postinstall obfuscation | 5 | popup/bundle.jspopup/styles.cssbg/bundle.js +2 more | - |
| LOW | postinstall network communication | 6 | _locales/en/messages.jsonpopup/bundle.jspopup/styles.css +3 more | - |
| LOW | LocalStorageShouldNotBeUsed | 2 | agreement/bundle.jspopup/bundle.js | - |
| LOW | NoUseEval | 1 | popup/bundle.js | - |
| LOW | postinstall file download | 4 | agreement/bundle.jspopup/bundle.jspopup/styles.css +1 more | - |
| LOW | SQLInjection | 1 | bg/bundle.js | - |
| LOW | NoUseWeakRandom | 3 | agreement/bundle.jspopup/bundle.jsbg/bundle.js | - |
Network Indicators
Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.
Loading network indicators
IoC detail rows are loaded outside the initial page render.
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
11 evidence rows available.
Finding Categories
YARA Rules Matched
13 rules(48 hits)Requested Permissions
17 permissionsManage other installed extensions
Control the browser's proxy settings
Access and modify data on every website you visit
Intercept, modify, and block all network requests
Read and modify cookies on all sites
AI Security Report
AI Security Review
Evidence context: threat category proxyware; evidence quality moderate.
The Troywell VPN Pro extension presents significant risk indicators despite lacking traditional malware signatures. The extension is published by an anonymous Gmail address ([email protected]) rather than a verified company or known VPN provider. This is a critical red flag for VPN extensions, which should be operated by identifiable organizations with privacy policies and security audits.
The extension contacts 11 suspicious domains that are inconsistent with legitimate VPN functionality. Domains like t.state.page, t.state.online, and t.state.analytics suggest state tracking infrastructure. The geolocation domains n.geocodeinfo.city, n.geocodeinfo.country, and location.city indicate the extension is collecting location data from users. Additional domains including locations.best, this.store, and rail-x.ps appear to be marketing or monetization endpoints. A legitimate VPN should not need to contact geolocation services or state tracking domains—these are characteristic of proxyware that routes user traffic through third-party infrastructure while harvesting browsing and location data.
The manifest.json declares the 'tabs' permission, which is standard for VPN extensions but becomes concerning when combined with anonymous publishing and suspicious domain contacts. This permission allows the extension to read browsing history and page content, which could be exfiltrated to the identified domains.
The 63 code-smell findings are typical false positives from broad YARA rules matching basic Node.js patterns (fetch, exec, crypto). No malware signatures, obfuscation, or secret findings were detected. However, the absence of malware signatures does not indicate safety—proxyware and data exfiltration tools often operate without triggering traditional malware detectors.
Counterargument: A skeptic might argue that 948 IoCs without malware signatures indicates false positive noise from the XIOC extractor, and that VPN extensions naturally contact many domains for server routing. This argument is incorrect because the specific domains identified (geocodeinfo.city, t.state.*, locations.best) are not legitimate VPN infrastructure domains. Legitimate VPNs from known companies contact their own server endpoints, not third-party geolocation and state tracking services. The domain names themselves reveal data collection intent rather than VPN functionality. The anonymous Gmail publisher further confirms this is not a legitimate VPN service.
This extension exhibits the classic proxyware profile: anonymous publisher, VPN category claim, and contacts to geolocation/tracking domains rather than legitimate VPN infrastructure.
Key Reasons
- Anonymous Gmail publisher for VPN extension
- Suspicious geolocation domains (n.geocodeinfo.city, location.city)
- State tracking domains (t.state.page, t.state.online, t.state.analytics)
- VPN category without identifiable company
- Tabs permission combined with data collection infrastructure
False Positive Considerations
- code-smell findings from broad YARA rules
- high IoC count from XIOC volume
Reviewed 2026-05-23; recommended action: escalate; model confidence 82%.
Chrome version history
Risk trend by version
2 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.
Pick any point on the chart to explore that version's code below.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace
Troywell VPN Lite - unlimited VPN proxy
[email protected]
种草星球-TikTok爆单神器,商品自动提报采集邀评【永久免费】
[email protected]
Kindredly - A safer, private web for families
[email protected]
Open Headers
[email protected]
100xBot
[email protected]
Rook
[email protected]