Adguard VPN — защита трафика
ommpoiidlmdogdmcchcdhaknjjmobldb
Risk Score
6.78
Risk Level:
High
Recommendation:
🚫 BLOCK
Top Risks
- THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Adguard Vpn — защита траф [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
- Brand impersonation: uses 'Adguard VPN' name with no affiliation to AdGuard — likely scam/phishing clone.
- proxy permission with only 7 installs and free-webmail dev: entire browser traffic can be rerouted to vpnfasters.space/myxavpn.pro.
- Install URL hijack to vpnfasters.space — third-party redirect on install is a strong monetization/tracking signal.
- Privacy policy is Google's own account policy, completely unscoped to this extension — no disclosure of data handling.
Evidence
- brand_impersonation_name store Title 'Adguard VPN' mimics registered AdGuard brand; dev is gmail user with no affiliation.
- install_url_hijack crx onInstalled opens https://vpnfasters.space/ — unknown third-party domain, monetization/tracking risk.
- js_external_hosts crx Extension contacts app.myxavpn.pro, vpnfasters.space, t.me — none are AdGuard domains.
- privacy_policy_unscoped store Policy URL is Google's global account privacy page; scope_extension=false, collects+shares data per classification.
- proxy_permission_tiny_install manifest proxy declared, only 7 installs, free-webmail dev — high-capability permission with minimal accountability.
- free_webmail_no_dev_name store imawocigi29@gmail.com numbered alias, empty developer_name — reputation floor triggered.
- small_install_high_perm_anomaly api install_perm_anomaly.small_install_high_perm=true: 7 installs with HIGH-tier proxy permission.
- install_count_minimal store Only 7 installs — essentially unpublished; combined with brand impersonation suggests early-stage attack vector.
- threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Adguard Vpn — защита траф [browser-hijack] + malext.io malicious_extension_sentry; score 4.28 -> 6.78 (+2.5 cap 2.5).
Permissions Breakdown
- proxy high Can redirect all browser traffic through attacker-controlled proxy server.
Pillar Scores
Permissions7.00
Reputation8.50
Network2.00
Webstore6.00
Maintenance0.00
Privacy10.00
Code Quality0.00
CVE Exposure0.00
Bookkeeping
Rubric v3.6
Scored at 2026-11-03 09:52
Listing SHA
ab068df613f8…
Force block
— not fired
Score recovered
no
Elapsed
—