VPN Unlimited - VPN Proxy for Edge
The AI review rates the findings as likely false positive, but the risk score (85/100) still counts them.
Analysis record
- Analysed
- 5 days ago
- Version
- v9.1.3
- Artifact
- SHA256 43F…D4E
- Source
- Findings (non-IoC)
Is VPN Unlimited - VPN Proxy for Edge safe?
VPN Unlimited for Edge is a proxy client: it hides your IP address on Wi-Fi, blocks WebRTC leaks and lets you pick a server location. Its code talks to api.vpnunlimitedapp.com and geo.keepsolidcdn.com, both operated by KeepSolid, the company that publishes VPN Unlimited, and it opens a socket connection from background.js so the popup can show tunnel status. Those are the network calls a VPN app has to make.
The scan flagged two kinds of thing. The first is a finding called OBFUSCATION-invisible_unicode_payload in js/i18n-g90LwdNP.js. Read that file name literally: it is the translations file. Zero-width characters in a translations file are normal letters in languages such as Sinhala, Kannada and Persian, and they do not run as code. The second is a long list of domain-shaped strings, including fragments like 3bb.bj and error.download that are pieces of minified JavaScript rather than addresses. Nothing in background.js or the popup reads your cookies, your passwords or your browsing history and sends them anywhere.
If the hidden-unicode finding were real, it would mean someone had smuggled instructions into the extension's language pack to run code behind your back. The scanner tripped on characters it treats as suspicious everywhere, including in files where they are just spelling. That is a limit of the scanner, not something this extension does.
No malware signature matched, no credential-stealing code turned up, and the traffic goes to the VPN provider's own servers.
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
13 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| LOW | postinstall crypto operations | 15 | js/paymentMethods-Bl5jZDcg.jsassets/paymentMethods-DO-2SVzC.cssjs/crypto-BzBr0tFK.js +12 more | - |
| LOW | postinstall network communication | 16 | assets/home-iVOUktDK.cssicons/pic_webrtc.svgfonts/ArialRegular.woff +13 more | - |
| LOW | postinstall file manipulation | 8 | js/userSettingsStorage-D25tNHoF.jsjs/bridge-CfbbAdAj.jsjs/browserStorage-CwlVZEjv.js +5 more | - |
| LOW | postinstall system command | 7 | js/bridge-CfbbAdAj.jsjs/i18n-D_tsjG8g.jsjs/crypto-BzBr0tFK.js +4 more | - |
| LOW | OriginsNotVerified | 1 | js/userSettingsStorage-D25tNHoF.js | - |
| LOW | postinstall environment access | 17 | js/paymentMethods-Bl5jZDcg.jsjs/i18n-D_tsjG8g.jsjs/purchases-Dzri9bqF.js +14 more | - |
| LOW | postinstall obfuscation | 12 | js/paymentMethods-Bl5jZDcg.jsjs/home-B4_4yJmi.jsjs/crypto-BzBr0tFK.js +9 more | - |
| LOW | LocalStorageShouldNotBeUsed | 1 | js/userSettingsStorage-D25tNHoF.js | - |
| LOW | postinstall file download | 12 | js/home-B4_4yJmi.jsjs/i18n-D_tsjG8g.jsjs/popup-DP01efU7.js +9 more | - |
| LOW | NoUseWeakRandom | 3 | background.jsjs/helpers-CyVoR7G1.jsjs/userSettingsStorage-D25tNHoF.js | - |
| LOW | credential generic tokens | 2 | js/bridge-CfbbAdAj.jsbackground.js | - |
| LOW | credential env files | 2 | js/bridge-CfbbAdAj.jsjs/userSettingsStorage-D25tNHoF.js | - |
| LOW | postinstall persistence mechanism | 1 | background.js | - |
Network Indicators
Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.
Loading network indicators
IoC detail rows are loaded outside the initial page render.
Publisher Evidence
Limited evidenceKeepSolid Inc.
Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Edge does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
13 evidence rows available.
Finding Categories
YARA Rules Matched
13 rules(97 hits)AI Security Report
AI Security Review
Evidence context: threat category none; evidence quality moderate.
VPN Unlimited for Edge advertises itself as a proxy for Wi-Fi protection, IP masking and WebRTC leak blocking. What the scan shows lines up with that job instead of contradicting it. background.js opens a socket connection and issues fetch calls (NET-SOCKET_IO-background.js-3, NET-FETCH-background.js-39), and js/popup-Ctm3Pyox.js does the same for the popup UI (NET-FETCH-js/popup-Ctm3Pyox.js-10). A VPN client needs exactly this: a persistent channel for tunnel state and an HTTPS call to a config or location service. The hosts it reaches are api.vpnunlimitedapp.com and geo.keepsolidcdn.com, both run by KeepSolid, the company behind VPN Unlimited, plus api.simplexsolutionsinc.com, the developer entity listed for the same product on other stores. The rackcdn.com hosts are Rackspace's CDN.
No malware signature matched anywhere in the package. Nothing in the findings targets login pages, cookies, credential stores or banking domains. The manifest contributes no permission or host-permission findings, and there are no dependency or tool-poisoning hits.
The 136 IoC entries are where the numbers get loud and stop meaning much. The endpoint list includes fragments such as 3bb.bj, cnc-.bj and ej.ss that are not hosts at all, along with property-access strings read as domains: error.contact, error.download and error.buy are what a minifier leaves behind when it shortens object properties. The rest (busyroom.net, cislunary.com, getvault.net, androidshopweb.rocks, changelly.com) sit in bundled JavaScript with no companion code in background.js or the popup that collects browsing history, cookies or form input and posts it out. IoC volume measures how much text the extractor parsed.
The single obfuscation finding is OBFUSCATION-invisible_unicode_payload at js/i18n-g90LwdNP.js. That path is the localisation bundle. Zero-width characters inside a translations file are writing-system characters for Sinhala, Kannada, Persian and Khmer, and they do not execute. Smuggled payloads live in executable code, not in a table of translated labels.
A sceptic would raise two points, and both deserve an answer. The store listing shows no developer name and no user count, which is the shape of a cloned listing. And socket.io in a VPN extension is the same plumbing a proxyware service would use to route strangers' traffic through your machine. On the first point, the binary carries the vendor's geo CDN and the developer entity's own API domain, which a throwaway clone has little reason to ship. On the second, the socket connections start in background.js to resolve tunnel state, and no findings show relay, exit-node or peer-discovery behaviour.
A runtime capture of the socket traffic would settle it. Nothing in this scan shows data leaving for anyone other than the signed-in user.
Key Reasons
- Network endpoints api.vpnunlimitedapp.com and geo.keepsolidcdn.com belong to KeepSolid, the publisher of VPN Unlimited, and api.simplexsolutionsinc.com is the developer entity for the same product.
- Zero malware signatures, zero credential-theft indicators and no IoCs against login or banking domains across 309 findings.
- The only obfuscation hit, OBFUSCATION-invisible_unicode_payload, sits in js/i18n-g90LwdNP.js, a localisation file where zero-width characters are legitimate script characters.
- 136 IoC entries are dominated by extractor fragments (3bb.bj, cnc-.bj, ej.ss) and minified property chains (error.contact, error.download, error.buy) that are not real hosts.
- NET-SOCKET_IO and NET-FETCH findings in background.js and js/popup-Ctm3Pyox.js match the expected behaviour of a VPN client maintaining tunnel state.
False Positive Considerations
- IoC extractor turning minified property chains and hex fragments into fake domains
- Zero-width Unicode flagged in an i18n locale bundle where it is legitimate script content
- Bundled/minified JavaScript triggering 94 code-smell rules
- Rackspace rackcdn.com asset hosts counted as network endpoints
Reviewed 2026-10-02; recommended action: suppress false positive; model confidence 76%.
Edge version history
Risk trend by version
5 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.
Pick any point on the chart to explore that version's code below.
Source Code Not Available
Source code is not available for this version of the extension.
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace