VPNs that you SHOULD AVOID...

---   Globus VPN – Globus VPN w   as identified in an academic paper because its Android VPN app is considered “malicious or intrusive.”

HatVPN – HatVPN was listed as #7 on the Top 10 most malware-infected Android VPN apps. Different forms of malware identified in the study included: adware, Trojan, malvertising, riskware, and spyware (see here for more info).

---   Hide My Ass – Hide My Ass (HMA) is a based in the United Kingdom – which is a bad location for privacy due to mandatory data retention and mass surveillance. Making matters worse, HMA has a troubling history of turning over customer data to law enforcement agencies around the world.

---   Hola – Hola is an Israel-based VPN service that has been caught stealing user bandwidth and fraudulently reselling it through their sister company Luminati. Hola users act as endpoints for the entire network. This means other people are using your bandwidth and IP address when you use Hola, and you can be busted for their activities. (Also discussed in the -----   Free VPNs guide.)

Hotspot Shield VPN – Hotspot Shield VPN was directly identified in an academic paper for “actively injecting JavaScript codes using iframes for advertising and tracking purposes” with their Android VPN app. Furthermore, analysis of Hotspot Shield VPN’s source code revealed they “actively use more than 5 different third-party tracking libraries.” They were also exposed for redirecting user traffic to e-commerce domains, such as alibaba.com and eBay.com through partner networks (See study here.). Users also complain about fraudulent activity after purchasing their paid VPN service. Also troubling is their Privacy and Security Policy which includes: third-party data sharing, IP address sharing, tracking, web browsing data collection, and geographical information.

Update: Hotspot Shield has also been in the news recently because there VPN was found to leave users vulnerable to having their location exposed. Hotspot said they are working on a fix. See additional information here.

---   Ip-shield VPN – Ip-shield VPN was found to be embedding third-party tracking libraries into their Android VPN app. These tracking libraries (such as NativeX and Appflood) are used to hit users with targeted ads, thereby monetizing the “free” app. (See here for more info.)

---   Ivacy VPN – Ivacy is a Hong Kong VPN provider that has some troubling issues. Their refund policylimits you to 500 MB of bandwidth and 30 sessions. Certain bloggers have also accused Ivacy of falsifying their VPN server locations, meaning that you’re not getting the locations you paid for. Many people believe that Ivacy and PureVPN are under the same company and using the same network infrastructure.

---   “No Logs” VPNs – There are countless VPNs claiming to be a “no logs” VPN service, and then burying their logging activities in their Privacy Policies. Instead of saying the word “log” they may refer to data that is “kept” or “stored” or “collected” by the VPN provider. Examples of this include Betternet, ProtonVPN, and PureVPN. While connection logs aren’t necessarily bad (see here), lying about logging policies and making contradictory claims is a growing problem.

---   One Click VPN – One Click VPN was listed as #9 on the Top 10 most malware-infected Android VPN apps. Different forms of malware identified in the study included: adware, Trojan, malvertising, riskware, and spyware (see here for more info).

---   Opera “Free VPN” – Opera’s browser now includes what it calls a “free VPN” which they say is “better for online privacy” (see here). First, this is not a VPN at all. Security experts have shown that this is just a web proxy, which uses API requests. Second, Opera’s privacy policies include statements about data collection (including usage data) and how this is shared with third parties (see here). If you’re still thinking about using Opera’s “free VPN” – OPERA VPN isnt a real VPN. Just a proxy.

---   PureVPN – My PureVPN review uncovered many problems. My testing identified continuous IPv6 leaks, IPv4 leaks, and DNS leaks with their VPN applications. Even more problematic, all of these leaks were detected with PureVPN’s leak protection “features” enabled, and the VPN client informing me that my “real IP address is hidden.” PureVPN was also caught handing over customer data to the FBI (US authorities) despite claiming to have a “zero log policy”.

---    Rocket VPN – Rocket VPN was identified in an academic paper because its Android VPN app is considered “malicious or intrusive” and it also tested positive for malware by VirustTotal.

---    SuperVPN – SuperVPN was listed as #3 on the Top 10 most malware-infected Android VPN apps. Different forms of malware identified in the study included: adware, Trojan, malvertising, riskware, and spyware (see here for more info).

---   Surfeasy – Surfeasy was found to be embedding third-party tracking libraries into their Android VPN app. These tracking libraries (such as NativeX and Appflood) are used to hit users with targeted ads, thereby monetizing the “free” app. Additionally, the Surfeasy privacy policy explains how they are collecting “usage data” – see here.

---   Spotflux VPN – Spotflux VPN was identified in an academic paper because its Android VPN app is considered “malicious or intrusive.”

Tigervpns – Tigervpns was identified in an academic paper because its Android VPN app is considered “malicious or intrusive” and it also tested positive for malware by VirustTotal.

---   VPN Free – VPN Free was identified in an academic paper because its Android VPN app is considered “malicious or intrusive” and it also tested positive for malware by VirustTotal.

---   VPN Master – There are many free VPNs offered in the Google Play or Apple stores using variations of the “VPN Master” name. Through testing I have found that these VPN Master apps are full of dangerous malware, despite having high ratings and millions of users. I even found that one of these free VPN apps called “VPN Master Free unlimed proxy” (sic) is owned and operated by a Chinese data collection company called TalkingData. [Read More…]

---   VPNSecure – VPNSecure is based in Australia – a 5 eyes country that is not good for privacy. VPNSecure was also identified in an academic paper for leaking IPv6 and DNS requests, which leaves its users exposed to “surveillance and malicious agents.” The same paper also noted that VPNSecure has a number of egress points in residential ISPs. This suggests that users are unknowingly being used as endpoints in a P2P-like bandwidth network – i.e. user bandwidth is being stolen (although the paper could not confirm this). (See here for more info.)

---   Wifi Protector VPN – Wifi Protector VPN was directly identified in an academic paper for “actively injecting JavaScript codes using iframes for advertising and tracking purposes” with their Android VPN app.

Conclusion...   Using no VPN is better than using a bad VPN.

Even if you didn’t find your VPN on this Warning List, be careful. Many popular and highly-rated VPNs have problems, such as IP leaks and non-working features.;

Malware can come in many different forms – but at the end of the day, it’s all about making money off you and your data. Malware hidden inside VPNs can steal your data, which can then be used to:

• hit you with targeted ads and spam emails
• hijack your online accounts
• steal your money (bank and credit card details)
• steal your digital goods or products
• lock or encrypt your devices in exchange for a payout (ransomware)

The number of free VPNs containing malware is truly frightening. The CSIRO study found that 38% of free Android VPNs contain malware. Even worse, many of the most dangerous free VPNs are highly rated and are being used right now by millions of people.

Here is one such example I found for the VPN Master article.

This free VPN app is called “VPN Master – Free VPN Proxy” and is officially listed in the Google Play store. Notice that it has a high rating (4.5) and about 100,000 downloads.

Unfortunately, the “VPN Master – Free VPN Proxy” app had eight positive hits for malware.

Below are the test results from VirusTotal:

Note: This is why you should never trust ratings in the Google Play and Apple stores.

You may just end up with a highly-rated bag of malware.

Just like with malware, hidden tracking aims to collect your private data.

The CSIRO study analyzed 283 VPNs and found that 75% of free VPN apps contained tracking embedded in the source code. These tracking libraries are a way for the free VPN to collect user data, which can be valuable for advertising and analytics.

Let’s take a quick look at one very popular example with Betternet, which is based in Canada.

The CSIRO study found that Betternet’s free VPN app for Android contained 14 different tracking libraries.

This is ironic given that Betternet markets its free VPN as a “security and privacy” ...  HERE IS the Betternet   review...   Extensive testing and research for this Betternet VPN review uncovered many concerning issues: embedded malware, tracking libraries, IP address leaks, DNS leaks, poor speeds, and bad reliability. Perhaps most concerning is the fact that Betternet has been caught embedding malware and tracking into their VPN apps, while promising to protect the privacy and security of its users. Betternet is yet another example showing the dangers of using free VPN services. 

Third-party tracking libraries hidden in free VPNs are just tools to collect your data.

This is the irony with most free VPNs – they are spyware disguised as privacy tools.

Trusting a free VPN to protect your privacy is kind of like trusting the wolf to guard the chickens.

Let’s take a closer look at one popular example – Opera’s “free VPN” service. (Note: Opera is not actually a VPN at all, but instead a web proxy; we’ll examine it anyway due to its popularity.)

When you examine the Opera Privacy Statement you can see that their “free VPN” service is actually just a data collection tool. And they know most people will focus on the word “free” instead of reading the fine print.

When working on the VPN Master article I even found one free VPN service that is owned by a Chinese data collection company.

The free Android VPN app called “VPN Master Free Unlimed Proxy” (sic) had nine positive malware test results and is owned by the Chinese data collection company TalkingData.

This is basically a three-step business model that anyone can follow:

1. Step 1: Offer a free VPN service and market it as a “privacy” solution.
2. Step 2: Collect user data through malware and tracking embedded in the VPN’s source code.
3. Step 3: Sell the data to advertisers and other companies.

Offering free products that collect your data is a very popular business model – just ask Facebook or Google. (This is how Google and Facebook dominate the online advertising industry.)

And speaking of Facebook, they are also cashing in on the free VPN scam.

Facebook was caught collecting user data through a free VPN app called Onavo. According to some reports, this free VPN has been downloaded by 24 million users and collects data on people’s app and website usage habits.

When you use these free products you are giving away your privacy, risking your security, and probably making someone else rich with your private data.

Some free VPNs are also stealing your bandwidth and reselling it to others.

One example of this is the Israel-based Hola VPN service. Hola was found to be stealing user bandwidth and then fraudulently reselling it through its sister company Luminati – see this article for more information.

Here you can see the Hola free VPN website at the top of the graphic below. Directly under the red line is the Luminati site, which sells bandwidth for a “business proxy network”.

Until this issue came to light, millions of Hola users were unknowingly having their bandwidth stolen and resold to third parties.

This put Hola’s free VPN users at risk while other people used their bandwidth for their own activities (similar to a P2P network).

There are many insidious ways for free VPN services to make money off their users.

Another technique is with browser hijacking. This is when the VPN hijacks and redirects your browser to partnership websites without your permission.

Let’s take a closer look at one such example: Hotspot Shield VPN.

Hotspot Shield was found to be redirecting HTTP requests to e-commerce sites, such as Alibaba and eBay, through its partner networks. The partner networks in this example were Conversant Media and Viglink – two online advertising companies.

These claims appear even more dubious since Hotspot Shield has also been caught embedding tracking libraries into their free VPN.

Note: Hotspot Shield was formally called out in a report filed before the Federal Trade Commission, which claimed:

Contrary to Hotspot Shield’s claims, the VPN has been found to be actively injecting JavaScript codes using iFrames for advertising and tracking purposes.

This is how free VPNs make money.

A good VPN should secure and encrypt all of the traffic between your device and the VPN server.

Unfortunately, I have found that many VPN services have problems with IP address leaks – i.e. when your IP address leaks out of the VPN tunnel (thus leaving you exposed). This is especially true with free VPNs.

A VPN can leak both IPv4 and IPv6 addresses out of the tunnel. This leaves you exposed when using your VPN service, which defeats the purpose of even using a VPN.

You can check to see if your VPN has problems using this basic VPN test guide.