The "VPN for X" Proxy Farm

Overview

Thirty-one Chrome extensions, published from three linked Google accounts ([email protected], [email protected], [email protected]), share a single codebase. Each is sold as a "VPN for" one blocked service: РуТрекер, YouTube, Telegram, Instagram, ChatGPT, Claude, Netflix, and more. Together they carry about 356,000 installs. The flagship, РуТрекер VPN, holds 200,000 of them.

We verified the mechanism on 3–4 September 2026 by reading the extension code and decoding its remote configuration. The roster, versions, and install counts above are from our own scans and analysis, last seen live on 18 September 2026.

How it works

Every extension in the set requests the proxy permission, registers a webRequestAuthProvider, and holds host access to <all_urls>. It configures the browser proxy through a PAC script whose target list is fetched from a remote source rather than shipped in the extension. That indirection is the point: the operator can change what traffic is proxied, and to which servers, after install and without pushing an update.

The "Total VPN" build goes further and proxies all traffic rather than a target list.

The remote server list is fetched from several redundant hosts, including a GitHub Pages site, a Blogspot page, a Google Doc, and a Telegram channel, and is obfuscated with a Caesar shift over base64. The decoded list carried proxy servers with shared credentials on a monthly expiry. A paid "VIP" tier is sold for 299 roubles through api.hhos.ru and mainapi.store.

Samples

We hold the analysed CRX build for 28 of the 31 extensions. Each is listed in the IOC table above by SHA-256, tagged with the extension and version it was pulled from, so a specific build can be matched against a copy found elsewhere. The version each entry was analysed at is recorded per extension in the roster.

Attribution notes

Three of the HTTPS fallback proxy hostnames in the decoded configuration (de8.staticvaultcdn.org, de4.servefaststatic.work, de34.rapidstaticserve.cc) match hostnames used by Browsec VPN's premium servers. This is a relationship worth recording, not an attribution: we did not establish who operates the farm, and we did not confirm that the farm can actually reach those servers. Treat it as a lead.

How to spot it

The pattern that defines this family is a "VPN for one website" that asks to proxy traffic across all sites and pulls its list of proxy servers from a public page it does not control, a GitHub Pages site, a blog, or a Telegram channel. A tool that decides where your browsing goes based on a list it downloads after install is not a tool you want.

If you have one installed, remove it. For administrators, the extension IDs and per-build SHA-256 hashes above are the roster to block and match, and a connection from a managed device to any of the listed configuration or subscription hosts is a lead worth chasing back to the extension that made it.