Free VPN Risk Index
The Risk Index put the 150 most popular free VPN Android apps to the test and discovered a disturbing number of privacy flaws.
This 2019 research has been superseded by the 2024 report Free Android VPN Security Flaws: 100 Apps Tested. Although the report is now outdated, these findings provide a useful comparison point with current data.
VPN Security Testing 2019 Findings
- Leaky VPNs: 25% failed to protect user privacy due to DNS and other leaks
- Pervasive problems: 85% featured excessive permissions or functions with potential for privacy abuses
- Long list of other security flaws and performance issues
Free Android VPNs: Potential Risks
We have created this Free VPN Risk Index to help users avoid using potentially unsafe free VPN apps that compromise their privacy and security.
Our study focuses on the technical performance of free Android VPN apps available on Google Play.
To create this Index, we first identified the top 150 free VPN apps by total installs. We tested for effective encryption, browser leaks, viruses and malware, dangerous app functions and behaviors, along with comprehensive network tests. We also analyzed excessive app permissions.
Many of our Risk Index findings are straightforward in what they reveal about individual free VPN apps. It’s clear, for example, that a DNS leak or network anomaly puts user privacy at risk.
Our findings on risky permissions and functions, however, need to be placed in proper context as they provide us with illuminating insight into the category of free mobile apps as a whole.
The mere presence of some of these intrusive permissions or risky functions may not be necessarily malicious but equally neither does that mean they are typically benign.
Some app permissions and functions facilitate the aggressive advertising keeping these VPNs “free” for example. What’s even more disturbing however is when location-based permissions and functionality are used to geo-target ads to users with an active VPN connection – which is not a practice with which many consumers would be comfortable.
The presence of such permissions and risky functions is also often a sign of an app development process where corners have been cut and user privacy was low on the list of priorities.
The results are VPN apps that just don’t do enough to earn user trust.
It’s standard practice for developers to use third-party libraries for common functionality. However problems arise when no-one takes the time to check for excessive, intrusive permissions and functions often bundled with them.
While it may not be realistic to hold free VPN apps to the same standard as paid, how are consumers to know whether developer are malicious or just lazy?
Some of the risky functions we identified may also be “dormant”, ie left in the code even as corresponding app permissions were removed, rendering them unable to successfully execute. However an app update could easily reinstate these permissions and catch some users unawares.
Then there’s the in-built protection offered by recent versions of Android where upon install, an app’s permissions are set to “denied” as default until the app requests they be granted. This doesn’t take into account less experienced users who tap OK without fully understanding what they are doing.
Our view is that – even putting more malicious scenarios aside – this state of affairs is nowhere near good enough and that consumers trying to protect their privacy deserve better. Nor does it have to be this way; none of these risky permissions or functions are present in top-rated VPN apps, or in leading free VPNs like Windscribe, which close the door to any potential privacy abuses.
Consumers determined to use a free VPN must absolutely do their research outside of the Play store, and look at free VPN recommendations based on expert VPN reviews.
See all of our investigations into the dangers of free VPN services.
Security Flaw: Data Leaks
- DNS leaks 25% (38 VPNs) failed tests for this type of leak
- WebRTC leaks 4 VPNs failed tests for this leak
- 2 VPNs showed evidence of the full sweep of leaks (DNS, WebRTC and IP address)
Jump to Testing Methodology | VPN Risk Index
We tested for three types of leak: DNS, WebRTC and IP address, all of which expose users’ true identity.
DNS leaks
38 VPNs exposed users via DNS leaks. This security flaw occurs when a VPN fails to force DNS requests through its encrypted tunnel to its own DNS servers and instead permits the DNS requests to be made directly to the default DNS servers used by the Internet Service Provider (ISP).
Even though the rest of a user’s traffic is concealed, such a leak exposes a user’s browsing history to their ISP and any third-party DNS server operator that it may use.
Not only does this defeat the purpose of using a VPN, such a leak would typically go undetected by a user unless they knew to test their connection.
WebRTC leaks
Only 4 VPNs suffered WebRTC leaks. WebRTC (or Web Real-Time Communication) is a browser-to-browser communication technology intended to deliver faster speeds for high-bandwidth applications like video chat.
The problem is that WebRTC communication not only requires a real IP address but can also bypass the VPN tunnel. It’s also possible for third-parties to exploit WebRTC functionality to request a user’s true IP address.
While less of a common problem than a DNS leak, these leaks also undermine VPN user privacy.
IP leaks
Only 2 VPNs suffered this fundamental leak, whereby a user’s true IP address is visible rather than being replaced by the IP address of the VPN. Given the standardized nature of our testing, the usual reasons for such leaks, such as the use of vulnerable older technologies like Flash, do not apply here.
These two VPNs (VPN super free and Super Fast Hot VPN) are essentially broken and not fit for purpose.
Security Flaw: Intrusive Permissions
- 67% of VPNs tested had intrusive permissions (100 VPNs). Each of these permissions is categorized as “dangerous” in the official Android developer documentation
- 25% of VPNs may ask users to grant permission to track their location (38 VPNs)
- 39% of VPNs may ask users to grant permission to access personal information about their device (59 VPNs)
- Other intrusive app permissions included use of the camera or recording via the microphone without a user’s knowledge, accessing contacts and even secretly sending SMS
Jump to Testing Methodology | VPN Risk Index
We found the following inappropriate intrusive app permissions were among those requested by the 150 VPNs in the index.
None of these permissions is necessary for the core functions of a VPN and each has the potential for privacy abuses. The table below indicates the number of VPNs featuring each permission.
While we also found additional excessive permissions, they were not considered intrusive and therefore not listed.
Aside from potentially malicious purposes, a proportion of these instances of intrusive permissions will arise from advertising practices. Ad platforms will require certain permissions to function while locations-based permissions enable geo-targeting of ads.
Others will have arisen from the use of third-party libraries for common functionality without due consideration given to the privacy implications of the permissions bundled therein.
Unfortunately for consumers, there is no way to determine whether a risky permission is there in order to spy on them, to better advertise to them or just as a result of poor development practices.
Note that permissions are set to “denied” upon app install and must be explicitly requested by the app and granted by the user.
Privacy Red Flags: Permissions
The following table highlights the app permissions with the highest risks to privacy and indicates the numbers of VPNs we tested that requested that permission.
It should be noted that in addition to the above active permissions we also discovered a number of deprecated permissions that are no longer supported by the Android operating system but were at one time considered high-risk.
Among these were the “get tasks” permission (found in 26 VPNs) that returned a list of tasks that the user had recently launched but was was deprecated due the potential to leak personal information. Similarly “read logs” (five VPNs) that’s no longer available to third-party apps due to privacy issues and “use credentials” permission in two apps that used to give apps access to user accounts such as their Google account.
While these permissions are no longer valid, it does raise the question of why there were included in the first place.
Security Flaw: Risky Functions
Identification of risky functions in the source code of tested VPNs was dependent on the availability of scan data from the Tencent Habo Malware Analysis System. Where no data was available, the result was recorded as “Not detected”. Therefore the number of apps displaying such behavior should be considered to be at the lower bound.
- 63% of all VPNs tested featured functions with the potential for privacy abuses not expected from a VPN app (95 VPNs)
- 87 of these VPNs displayed the
LocationManager;-getLastKnownLocationbehavior, whose function is to get the last known location of the device. However, 56 of the VPNs did not request the corresponding permission.
Jump to Testing Methodology | VPN Risk Index
We detected the following risky Java commands and functions in the source code when scanning the 150 VPNs in the index using the VirusTotal tool.
On the face of it, none of these functions is necessary for a VPN to function and each has the potential for privacy abuses. The table indicates the number of VPNs featuring each permission.
While we also found additional functions flagged as risky, they were not considered to have potential privacy implications and therefore are not listed.
As with the intrusive permissions elsewhere in this report, the reason for their presence will vary by VPN.
Some will be legitimate – and where developers have been able to provide justification for their use, we have included this in the relevant app summary in the Index.
Many more will be to enable more effective – and targeted – advertising, something we believe is at odds with the concept of VPN.
What we don’t know is how many are being used for malicious purposes or, even more worryingly, could be exploited at some point in the future.
Privacy Red Flags: Risky Functions
The following table highlights the functions with privacy implications that we identifed via scans of the VPN apps’ source code and indicates the number of VPNs found to contain each function.
Note: we only found one instance of the ContentResolver;->query (Read database like contact or SMS) function where there was also the corresponding permissions: Free Proxy Master. Due to the broadness of the function, all other instances were discounted.
Of particular concern are the two instances of VPNs that feature both the Camera;->open function and the corresponding permission: SkyVPN and Squid VPN.
Security Flaw: Viruses & Malware
All VPN app binaries were uploaded to VirusTotal, which performs scans using over 60 utilities. The resulting reports are publicly available.
- 18% of all VPNs returned positive matches when scanned for potential viruses or malware (27 VPNs)
Jump to Testing Methodology | VPN Risk Index
Security Flaw: Network Testing Results
Network tests were completed on 103 VPNs. Of the remaining 47 VPNs, 36 appeared to be blocking testing traffic while nine failed to create a functioning network to test.
- 38% of tested VPNs displayed at least one “major abnormality” in their network testing results (39 of 103 VPNs), which largely centred around red-flag DNS behavior
- 14% of VPNs used DNS servers included on significant blacklists, which can prevent users accessing sites while connected to that VPN.
- 95% of tested VPNs displayed at least one “minor aberration” in their network testing results (98 of 103 VPNs)
- 50% had at least four “minor aberrations”
- 22% had at least six “minor aberrations”
- 62% of tested VPNs had TCP blocked on at least one port (64 of 103 VPNs). While typically temporary rather than permanent blocks, the end result is an unreliable internet experience with browsers displaying errors before eventually loading pages, email clients failing to immediately download messages etc
- 53% of tested VPNs failed to process all DNS types, most importantly EDNS0, which allows larger UDP packet sizes (>512 bytes). This DNS type is becoming increasingly common, in particular as more queries are made using the cryptographic DNSSEC extension, to ensure DNS responses are valid and are not being changed by a MITM attack. For users of these VPN apps, these DNS queries may be slower than normal, or even not resolve successfully resulting in an “unknown host” message instead of the desired web page.
- 52% of tested VPNs had various network performance issues: packet loss, high latency, low bandwidth, high packet buffering (54 of 103 apps). These issues cause particular problems with VOIP, video calling and gaming however they can also severely slow down the overall internet experience, especially in combination with each other.
Jump to Testing Methodology | VPN Risk Index
The following detailed results are grouped into major abnormalities and minor aberrations.
See full network test results for all apps as a Google Doc.
Major Abnormalities
14 VPNs using DNS servers listed on significant blacklists, which can prevent users accessing sites while connected to that VPN.
7 VPNs returned unexpected results when looking up important names, which according to the International Computer Science Institute at Berkeley, “could be caused by an error somewhere in the domain information, deliberate blocking or redirection of a site using DNS, or it could be that your ISP’s DNS Server is acting as a DNS ‘Man-in-the-Middle’.”
22 VPNs were using DNS servers that were slow to look up names, meaning page loads times would be noticeably slow and sometimes even fail to load.
2 VPNs used transparent proxies that were vulnerable to attack.
5 VPNs used in-network HTTP caches that incorrectly cached information, raising concerns about caching information when explicitly being told not to and thus may be serving out-of-date or private data. There is also a risk in such behavior of storing and serving up other users’ session data in the event of two users accessing the same website.
Minor Aberrations
64 VPNs had TCP blocked on at least one port. While this was typically temporary rather than permanent blocks, the consequence is a very glitchy and unreliable internet experience with browsers displaying errors before eventually loading pages, email clients failing to immediately download messages etc
30 VPNs had UDP blocked on at least one port. While web browsers don’t use this protocol, other apps may be glitchy, reporting intermittent connection errors.
54 VPNs had various network performance issues: packet loss, high latency, low bandwidth, high packet buffering These issues cause particular problems with VOIP, video calling and gaming however they can also severely slow down the overall internet experience, especially in combination with each other.
27 VPNs failed to process all DNS types, most importantly EDNS0, which allows larger UDP packet sizes (512 bytes). This DNS type is increasingly being used to ensure websites load as quickly as possible, a critical priority for web developers. For users of these VPN apps, these DNS queries may not resolve successfully resulting in an “unknown host” message instead of the desired web page.
5 VPNs employed content filters that blocked file types such mp3s, .exe and torrents, which would prevent users downloading such files even from legitimate sources.
32 VPNs employed at least one proxy (typically on 10 or more ports). The presence of proxies raises potential concerns of covert monitoring of activity by the VPN provider. At the very least, proxies intercept activity such as DNS queries, which may cause applications to stop working as expected.
4 VPNs displayed strange behavior where IP addresses were different for HTTP traffic vs non-HTTP traffic
We also found instances (such as VPN Express) where the VPN forced UDP requests to their own DNS server over port 53 without giving the option to override this. Given the lack of privacy policy protections, opens up the possibility of logging.
To learn more on this topic, read our full guide to IP, DNS, WebRTC, and IPv6 leaks.
Free VPN Risk Index
The following tables summarize our findings by VPN app. To make the Index easier to navigate, we have ordered the VPNs by number of installs from greatest to fewest and grouped them as follows (click to jump directly to that group of apps):
Apps 1-20 | Apps 21-40 | Apps 41-60 | Apps 61-80 | Apps 81-100 | Apps 101-120 | Apps 121-150
VPN Risk Index Summary: Apps 1-20
Detailed Findings by Free VPN App
View this Reference document for links to Google Play Store listings of individual apps.
Hotspot Shield Free VPN Proxy & Wi-Fi Security
VPN Details
VPN Developer: AnchorFree GmbH
APK file name: hotspotshield.android.vpn
VPN App Installs
50,000,000+ | 4.3 star rating
Intrusive App Permissions
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
Leaks
No leaks
Dangerous Functions/Behaviors
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- LocationManager;->getLastKnownLocation | Get last known location
- ActivityManager;->killBackgroundProcesses | Kill process like AV
- java/lang/Runtime;->exec | Execute system command
Virus Test Positives
None
Network Test Results
- Major abnormalities: 3
- Minor aberrations: 6
VPN Provider Response
Hotspot Shield provided a very detailed response. Summary as follows:
- READ_PHONE_STATE is used to ensure no upsell screens or app notifications interrupt a user while on a call. HSS states they store no information on user phone numbers nor serial numbers and provided evidence of transparency audits.
- WRITE_EXTERNAL_STORAGE enables a disk clean-up feature bundles with the app.
- ActivityManager;->killBackgroundProcesses enables a battery life improvement feature by killing background processes.
- TelephonyManager;->getDeviceId is used to get the SIM country for geo targeting things like GDPR based on user country. HSS emphasised that they never store or log the user IP address.
- LocationManager;->getLastKnownLocation is used for city-level targeting of features to different regions when inside the VPN tunnel. HSS state they only use this in real time and do not store user location or user IP addresses.
- java/lang/Runtime;->exec is used by the Paypal Braintree 3rd party library, to allow users to purchase subscriptions using Paypal.
Our view is that Hotspot Shield Free takes appropriate steps to mitigate the risks associated with the permissions and functions identified above, especially as their claims are backed up by security and transparency audits. While we will never be comfortable with using location data to target ads to VPN users, their senior management’s detailed responses have satisfied us that sufficient protections are in place that user privacy is not at risk. Using any free VPN involves a trade-off and at least with Hotspot Shield Free, it is in all other respects one of the better free VPNs available.
SuperVPN Free VPN Client
VPN Details
VPN Developer: SuperSoftTech
APK file name: com.jrzheng.supervpnfree
VPN App Installs
50,000,000+ | 4.3 star rating
Intrusive App Permissions
- ACCESS_COARSE_LOCATION
- ACCESS_FINE_LOCATION
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
Leaks
DNS leak
Dangerous Functions/Behaviors
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- LocationManager;->getLastKnownLocation | Get last known location
Virus Test Positives
None
Network Test Results
- Major abnormalities: 1
- Minor aberrations: 4
See full network test results.
Read our full SuperVPN review.
Hi VPN – Super Fast VPN Proxy, Secure Hotspot VPN
VPN Details
VPN Developer: Hi Security
APK file name: com.ehawk.proxy.freevpn
VPN App Installs
10,000,000+ | 4.6 star rating
Intrusive App Permissions
- ACCESS_COARSE_LOCATION
- ACCESS_FINE_LOCATION
- WRITE_EXTERNAL_STORAGE
- READ_PHONE_STATE
Leaks
DNS leak
Dangerous Functions/Behaviors
- LocationManager;->getLastKnownLocation | Get last known location
Virus Test Positives
None
Network Test Results
Major abnormalities: 0
Minor aberrations: 4
Hotspot Shield Basic – Free VPN Proxy & Privacy
VPN Details
VPN Developer: AnchorFree GmbH
APK file name: hssb.android.free.app
VPN App Installs
10,000,000 | 4.5 stars
Intrusive App Permissions
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
Leaks
No leaks
Dangerous Functions/Behaviors
None found
Virus Test Positives
None
Network Test Results
Major abnormalities: 3
Minor aberrations: 6
VPN Provider Response
Hotspot Shield provided a very detailed response. Summary as follows:
- READ_PHONE_STATE is used to ensure no upsell screens or app notifications interrupt a user while on a call. HSS states they store no information on user phone numbers nor serial numbers and provided evidence of transparency audits.
- WRITE_EXTERNAL_STORAGE enables a disk clean-up feature bundles with the app.
Our view is that the explanations for these permissions appear legitimate, especially as their claims are backed up with security and transparency audits. See the response for Hotspot Shield Free for additional information.
Read our full Hotspot Shield Free review.
Psiphon Pro – The Internet Freedom VPN
VPN Details
VPN Developer: Psiphon Inc.
APK file name: com.psiphon3.subscription
VPN App Installs
10,000,000+ | 4.3 star rating
Intrusive App Permissions
- ACCESS_COARSE_LOCATION
- WRITE_EXTERNAL_STORAGE
Leaks
No leaks
Dangerous Functions/Behaviors
- LocationManager;->getLastKnownLocation | Get last known location
- java/lang/Runtime;->exec | Execute system command
Virus Test Positives
None
Network Test Results
Major abnormalities: 0
Minor aberrations: 3
VPN Provider Response
Psiphon provided a swift and detailed response, as follows:
- WRITE_EXTERNAL_STORAGE allows the built-in browser to download files.
- java/lang/Runtime;->exec – org.zirco.utils.ProxySettings class is used to set the built in browser’s proxy settings.
- LocationManager;->getLastKnownLocation & ACCESS_COARSE_LOCATION is used to get the WiFi SSID in order to facilitate reconnections.
Our view is that these are legitimate uses of the permissions and functions, particularly as Psiphon is open source (unusual for a VPN). However, we remain concerned that the use of location-based permissions/functions for reconnection is could be open to abuse and that there are safer ways to achieve the same outcome.
Read our full Psiphon Pro review
Turbo VPN – Unlimited Free VPN & Fast Security VPN
VPN Details
VPN Developer: Innovative Connecting
APK file name: free.vpn.unblock.proxy.turbovpn
VPN App Installs
10,000,000+ | 4.7 star rating
Intrusive App Permissions
None
Leaks
DNS leak
Dangerous Functions/Behaviors
- LocationManager;->getLastKnownLocation | Get last known location
- java/net/Runtime;->exec | Execute system command
Virus Test Positives
None
Network Test Results
Blocks test traffic
VPN Provider Response
The developers provided a detailed response, summary as follows:
Note that the same developers are also responsible VPN Master, for which they provided a very similar response.
- LocationManager. ->getLastKnownLocation
- ContentResolver; ->delete
- TelephonyManager;->getDeviceId
The devs acknowledged that the third-party advertising platforms they use do seek to obtain sensitive information “for personalized advertising purpose”. However the devs stated they did not request the necessary permissions in order to protect user privacy.
Beyond using the user’s country to provide the fastest server, however, the devs did not specify what the functions were actually used for.
- Java/lang/Runtime; >exec | Execute system command
“Since we already have over 5,000 servers, in order to improve the user experience, we will ping if necessary, so as to select the most suitable server for different user.”
Our view is as follows: to quote the developers, “To help people to get a better Internet access in terms of privacy security, we offer free VPN services. Our products have a large number of users, which means we need a lot of servers to support, and we need advertisement to generate revenue so as to keep our business going.” This is the conflict at the heart of ad-supported free VPN apps in a nutshell. While the devs may well currently be acting in good faith, there is no guarantee for the user that future updates don’t include the necessary permissions to activate the functions listed. In the event of financial pressures for example, the lure of extra advertising dollars from 10 million users would be hard to resist.
Read our full Turbo VPN review.
VPN Master – Free unblock Proxy VPN & security VPN
VPN Details
VPN Developer: Innovative Connecting
APK file name: free.vpn.unblock.proxy.vpnmaster
VPN App Installs
10,000,000+ | 4.6 star rating
Intrusive App Permissions
None
Leaks
DNS leak
Dangerous Functions/Behaviors
- LocationManager;->getLastKnownLocation | Get last known location
- java/net/Runtime;-?exec | Execute system command
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
Virus Test Positives
None
Network Test Results
Blocks test traffic
VPN Provider Response
After initially giving us the brush-off, the developers provided a detailed response, summary as follows:
Note that the same developers are also responsible Turbo VPN, for which they provided a very similar response.
- LocationManager. ->getLastKnownLocation
- ContentResolver; ->delete
- TelephonyManager;->getDeviceId
The devs acknowledged that these functions could be used to collect sensitive as well as non-sensitive information, stating that the “the [third-party] advertising platforms are trying to obtain those information [sic] for personalized advertising purpose”. However the devs stated they did not request the necessary permissions in order to protect user privacy.
Beyond using the user’s country to provide the fastest server, however, the devs did not specify what the functions were actually used for.
- Java/lang/Runtime; >exec | Execute system command
“Since we already have over 1,000 servers, in order to improve the user experience, we will ping if necessary, so as to select the most suitable server for different user.”
Our view is that while the devs may well currently be acting in good faith, there is no guarantee for the user that future updates don’t include the necessary permissions to activate the functions listed. In the event of financial pressures for example, the lure of extra advertising dollars from 10 million users would be hard to resist.
Snap VPN – Unlimited Free & Super Fast VPN Proxy
VPN Details
VPN Developer: Lemon Clove
APK file name: free.vpn.unblock.proxy.vpnpro
VPN App Installs
10,000,000+ | 4.6 star rating
Intrusive App Permissions
- ACCESS_COARSE_LOCATION
- ACCESS_FINE_LOCATION
Leaks
DNS leak
Dangerous Functions/Behaviors
- LocationManager;->getLastKnownLocation | Get last known location
- java/lang/Runtime;->exec | Execute system command
Virus Test Positives
None
Network Test Results
Blocks test traffic
Read our full Snap VPN review.
Hola Free VPN Proxy
VPN Details
VPN Developer: Hola
APK file name: org.hola
VPN App Installs
10,000,000+ | 4.5 star rating
Intrusive App Permissions
- ACCESS_FINE_LOCATION
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
Leaks
- DNS leak
- WebRTC leak
Dangerous Functions/Behaviors
- LocationManager;->getLastKnownLocation | Get last known location
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
Virus Test Positives
None
Network Test Results
Major abnormalities: 0
Minor aberrations: 3
VPN Provider Response
Hola provided a swift response that was rather lacking in detail. Summary as follows:
- ACCESS_FINE_LOCATION & LocationManager;->getLastKnownLocation are used in Hola’s integrated Unblocker Browser. They claim this is necessary for “any standard browser”.
- READ_PHONE_STATE & TelephonyManager;->getDeviceId are used to stop data transmission when a call is active.
- WRITE_EXTERNAL_STORAGE – no explanation provided
Our view is that these are weak justifications for these combinations of intrusive permissions and risky functions. Not only is it possible for an integrated browser to function without access to GPS data but it’s also not core functionality for a VPN. Nor do we see the highly intrusive READ_PHONE_STATE permission on paid-for VPN apps that provider higher-level performance than Hola.
Read our full Hola review.
SpeedVPN Free VPN Proxy
VPN Details
VPN Developer: GoSpeed Software
APK file name: us.gospeed.speedvpn
VPN App Installs
10,000,000+ | 4.3 star rating
Intrusive App Permissions
- ACCESS_COARSE_LOCATION
- ACCESS_FINE_LOCATION
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
- READ_EXTERNAL_STORAGE
Leaks
No leaks
Dangerous Functions/Behaviors
- LocationManager;->getLastKnownLocation | Get last known location
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- java/lang/Runtime;->exec | Execute system command
Virus Test Positives
None
Network Test Results
Major abnormalities: 1
Minor aberrations: 3
VPN Private
VPN Details
VPN Developer: VPN Private
APK file name: us.unbounded.vpn_private
VPN App Installs
10,000,000+ | 4.6 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Functions/Behaviors
- ContactResolver;->query | Read databases like contacts or SMS
- LocationManager;->getLastKnownLocation | Get last known location
- java/lang/Runtime;->exec | Execute system command
Virus Test Positives
None
Network Test Results
- Major abnormalities: 0
Minor aberrations: 2
VPN Response
VPN Private provided a swift and reasonably detailed response and were at pains to emphasize that they do not store identifiable information about users while connection metadata is stored for less than a day. Summary as follows:
- ContentResolver;->query is used to get device ID to let a user get access to their servers.
- LocationManager;->getLastKnownLocation & java/lang/Runtime;->exec are both used by OpenVPN and IPSec connected libraries, with the developer claiming not to personally interact with them on any level.
Our view is that while these methods may well be used in good faith, this does not mean that they are optimal from a privacy perspective. The more personal data that is sought and used by an app, the greater the risk and vulnerability created.
VPN Free – Betternet Hotspot VPN & Private Browser
VPN Details
VPN Developer: Betternet LLC
APK file name: com.freevpnintouch
VPN App Installs
10,000,000+ | 4.5 star rating
Intrusive App Permissions
- WRITE_EXTERNAL_STORAGE
Leaks
No leaks
Dangerous Functions/Behaviors
- None
Virus Test Positives
None
Network Test Results
- Major abnormalities: 2
- Minor aberrations: 7
VPN Provider Response
Betternet sent a canned response, as follows only to close the issue the next day.
“Thank you for contacting us about the possibility of working with us.
“Your message was passed on to the proper team for review. If there is interest, they will be in touch with you.
Thank you again and have a great day.”
Our view is that this is an incredibly disrespectful way to treat the issue of user privacy.
Read our full Betternet Free review.
Touch VPN -Free Unlimited VPN Proxy & WiFi Privacy
VPN Details
VPN Developer: TouchVPN Inc.
APK file name: com.northghost.touchvpn
VPN App Installs
10,000,000+ | 4.5 star rating
Intrusive App Permissions
- READ_PHONE_STATE
- ACCESS_COARSE_LOCATION
- WRITE_EXTERNAL_STORAGE
Leaks
No leaks
Dangerous Functions/Behaviors
- None
Virus Test Positives
None
Network Test Results
- Major abnormalities: 1
- Minor aberrations: 3
Read our full Touch VPN review.
AnonyTun
VPN Details
VPN Developer: Art Of Tunnel
APK file name: com.anonytun.android
VPN App Installs
5,000,000+ | 4.2 star rating
Intrusive App Permissions
- WRITE_EXTERNAL_STORAGE
Leaks
No leaks
Dangerous Functions/Behaviors
- LocationManager;->getLastKnownLocation | Get last known location
Virus Test Positives
None
Network Test Results
Major abnormalities: 0
Minor aberrations: 3
VPN Provider Response
The AnonyTun developers provided a brief response as follows:
- WRITE_EXTERNAL_STORAGE allows users to save a configuration that they can export or share with fellow users.
- “For the rest of the stuff , they may be coming from Google SDK, we have no need for users sms or location.”
Our view is that this shows – at best – a disturbing lack of knowledge of how their own app works that should give users pause for thought before entrusting them with their internet activity and all the personal data that entails.
Super VPN – Best Free Proxy
VPN Details
VPN Developer: SuperVPN Inc
APK file name: com.chengcheng.FreeVPN
VPN App Installs
5,000,000+ | 4.6 star rating
Intrusive App Permissions
- READ_PHONE_STATE
Leaks
No leaks
Dangerous Functions/Behaviors
- LocationManager;->getLastKnownLocation | Get last known location
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- java/lang/Runtime;->exec | Execute system command
Virus Test Positives
None
Network Test Results
- Major abnormalities: 0
- Minor aberrations: 1
EasyOvpn – Plugin for OpenVPN
VPN Details
VPN Developer: Easy4U Ltd.
APK file name: com.easyovpn.easyovpn
VPN App Installs
5,000,000+ | 4.2 star rating
Intrusive App Permissions
- READ_PHONE_STATE
- READ_EXTERNAL_STORAGE
Leaks
No leaks
Dangerous Functions/Behaviors
- LocationManager;->getLastKnownLocation | Get last known location
Virus Test Positives
None
Network Test Results
- Major abnormalities: 0
- Minor aberrations: 6
Secure VPN – A high speed, ultra secure VPN
VPN Details
VPN Developer: Signal Lab
APK file name: com.fast.free.unblock.secure.vpn
VPN App Installs
5,000,000 | 4.2 star rating
Intrusive App Permissions
- BLUETOOTH
Leaks
DNS leak
Dangerous Functions/Behaviors
None
Virus Test Positives
None
Network Test Results
- Major abnormalities: 0
- Minor aberrations: 3
Thunder VPN – A Fast, Unlimited, Free VPN Proxy
VPN Details
VPN Developer: Signal Lab
APK file name: com.fast.free.unblock.thunder.vpn
VPN App Installs
5,000,000 | 4.8 star rating
Intrusive App Permissions
- BLUETOOTH
Leaks
- DNS leak
Dangerous Functions/Behaviors
- LocationManager;->getLastKnownLocation | Get last known location
- ActivityManager;->killBackgroundProcesses | Kill processes like AV
Virus Test Positives
None
Network Test Results
- Major abnormalities: 0
- Minor aberrations: 3
Read our full Thunder VPN review.
Yoga VPN – Free Unlimited & Secure Proxy & Unblock
VPN Details
VPN Developer: Sarah Hawken
APK file name: com.yogavpn
VPN App Installs
5,000,000+ | 4.7 star rating
- ACCESS_COARSE_LOCATION
- ACCESS_FINE_LOCATION
- READ_PHONE_STATE
Leaks
- DNS leak
- WebRTC leak
Dangerous Functions/Behaviors
- LocationManager;->getLastKnownLocation | Get last known location
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- java/lang/Runtime;->exec | Execute system command
Virus Test Positives
None
Network Test Results
Blocks test traffic
X-VPN – Free Unlimited VPN Proxy
VPN Details
VPN Developer: Free Connected Limited
APK file name: com.security.xvpn.z35kb
VPN App Installs
5,000,000+ | 4.5 star rating
Intrusive App Permissions
- WRITE_EXTERNAL_STORAGE
Leaks
No leaks
Dangerous Functions/Behaviors
- LocationManager;->getLastKnownLocation | Get last known location
- java/lang/Runtime;->exec | Execute system command
Virus Test Positives
None
Network Test Results
- Major abnormalities: 0
- Minor aberrations: 5
VPN Provider Response
X-VPN developers provided a swift and detailed response, summary as follows:
- WRITE_EXTERNAL_STORAGE – required in order to serve adverts on devices running certain versions of Android.
- java/lang/Runtime;->exec allows them to see whether a device has been rooted, which helps with troubleshooting connection issues on such devices. The dev says they plan to remove this soon as they have found a better way of achieving this.
- LocationManager;->getLastKnownLocation – The developer was unaware of the presence of this function in their code, so we shared our data with them for further investigation.
Our view is that while the developer response certainly shows a lack of malicious intent and that this app is relatively low risk, it’s illustrative of the price you pay for a free VPN app. Certain ad platforms require intrusive permissions for example. We are also concerned that this app may contain functions that the developer is unaware of and we will update as we learn more.
Read our full X-VPN Free review.
TunnelBear VPN
VPN Details
VPN Developer:TunnelBear, LLC
APK file name: com.tunnelbear.android
VPN App Installs
5,000,000+ | 4.5 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Functions/Behaviors
None
Virus Test Positives
None
Network Test Results
- Major abnormalities: 0
- Minor aberrations: 5
FlashVPN Free VPN Proxy
VPN Details
VPN Developer: FlashSoftware
APK file name: net.flashsoft.flashvpn.activity
VPN App Installs
5,000,000+ | 4.4 star rating
Intrusive App Permissions
- ACCESS_FINE_LOCATION
- READ_PHONE_STATE
- ACCESS_COARSE_LOCATION
- WRITE_EXTERNAL_STORAGE
Leaks
No leaks
Dangerous Functions/Behaviors
- LocationManager;->getLastKnownLocation | Get last known location
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- java/lang/Runtime;->exec | Execute system command
Virus Test Positives
None
Network Test Results
- Major abnormalities: 0
- Minor aberrations: 3
VPN Robot – Free Unlimited VPN Proxy &WiFi Security
VPN Details
VPN Developer: Lemon Clove
APK file name: free.vpn.unblock.proxy.freenetvpn
VPN App Installs
5,000,000+ | 4.6 star rating
Intrusive App Permissions
- ACTIVITY_RECOGNITION
Leaks
DNS leak
Dangerous Functions/Behaviors
None
Virus Test Positives
None
Network Test Results
Blocks test traffic
Unlimited Free VPN Monster – Fast Secure VPN Proxy
VPN Details
VPN Developer: Autumn Breeze 2018
APK file name: free.vpn.unblock.proxy.vpnmonster
VPN App Installs
5,000,000+ | 4.7 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Functions/Behaviors
None
Virus Test Positives
None
Network Test Results
Blocks test traffic
TapVPN Free VPN
VPN Details
VPN Developer: Mobbo
APK file name: pm.tap.vpn
VPN App Installs
5,000,000+ | 4.3 star rating
- ACCESS_FINE_LOCATION
- ACCESS_COARSE_LOCATION
- WRITE_EXTERNAL_STORAGE
Leaks
No leaks
Dangerous Functions/Behaviors
- LocationManager;->getLastKnownLocation | Get last known location
- java/lang/Runtime;->exec | Execute system command
Virus Test Positives
None
Network Test Results
- Major abnormalities: 0
- Minor aberrations: 2
Ultrasurf (beta) – Unlimited Free VPN Proxy
VPN Details
VPN Developer: Ultrareach
APK file name: us.ultrasurf.mobile.ultrasurf
VPN App Installs
5,000,000+ | 4.6 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Functions/Behaviors
- LocationManager;->getLastKnownLocation | Get last known location
Virus Test Positives
- Ad-Aware: Android.Riskware.FakeApk.gUKNG
- Arcabit: Android.Riskware.FakeApk.gUKNG
- BitDefender: Android.Riskware.FakeApk.gUKNG
- Cyren: AndroidOS/GenBl.A36902B7!Olympus
- Emsisoft: Android.Riskware.FakeApk.gUKNG
- F-Secure: Android.Riskware.FakeApk
- GData: Android.Riskware.FakeApk.gUKNG
- K7GW: Trojan ( 0001140e1 )
- eScan: Android.Riskware.FakeApk.gUKNG
Network Test Results
- Major abnormalities: 1
- Minor aberrations: 8
VPN Provider Response
Ultrasurf responded quickly but denied that the tests were accurate:
“We don’t use LocationManager and ContentResolver. We don’t know why there are false positives etierh [sic]. The app is extremely simple, it just sets up [a] VPN service and tunnel[s] the network traffic in an encrypted tunnel.”
Our view is that this is clearly an app to avoid given the many issues uncovered in our tests.
Free VPN Unlimited Proxy – Proxy Master
VPN Details
VPN Developer: Hotspot VPN( Proxy & Security )
APK file name: com.freevpn.unblock.proxy
VPN App Installs
5,000,000+ | 4.6 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Functions/Behaviors
- LocationManager;->getLastKnownLocation | Get last known location
- PowerManager;->reboot | Reboot phone
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- TelephonyManager;->getLine1Number | Get phone number
- TelephonyManager;->getSimSerialNumber | Get SIM serial number
- SmsManager;->sendTextMessage | Send normal SMS
- ActivityManager;->killBackgroundProcesses | Kill processes like AV
- java/lang/Runtime;->exec | Execute system command
Virus Test Positives
- ESET-NOD32: a variant of Android/DataCollector.Utilcode.A, potentially unsafe
Network Test Results
Blocks test traffic
Zero VPN
VPN Details
VPN Developer: TNTAPP
APK file name: net.tntapp.app.zerovpn
VPN App Installs
1,000,000+ | 4.3 star rating
Intrusive App Permissions
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
Leaks
No leaks
Dangerous Functions/Behaviors
None
Virus Test Positives
- Jiangmin: DoS.Linux.wp
Network Test Results
Blocks test traffic
HOT VPN – Free?Unblock?Proxy
VPN Details
VPN Developer: Autumn Breeze 2018
APK file name: co.acnet.hotvpn
VPN App Installs
1,000,000+ total installs | 4.6 star rating
Intrusive App Permissions
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
Leaks
No leaks
Dangerous Behaviors/Functions
- LocationManager;->getLastKnownLocation | Get last known location
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- java/lang/Runtime;->exec | Execute system command
- ContentResolver;->delete | Delete contact or sms
Virus Test Positives
None
Network Test Results
Blocks test traffic
Hammer VPN
VPN Details
VPN Developer: TunnelGuru
APK file name: com.in.hammervpn
VPN App Installs
1,000,000+ total installs | 4.6 star rating
Intrusive App Permissions
- ACCESS_FINE_LOCATION
- READ_EXTERNAL_STORAGE
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
Leaks
No leaks
Dangerous Functions/Behaviors
- java/lang/Runtime;->exec | Execute system command
- LocationManager;->getLastKnownLocation | Get last known location
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- TelephonyManager;->getSimSerialNumber | Get SIM serial number
Virus Test Positives
- Babable: PUP.HighConfidence
Network Test Results
- Major abnormalities: 0
- Minor aberrations: 2
Troid VPN Free VPN Proxy
VPN Details
VPN Developer: TunnelGuru
APK file name: com.in.troidvpn
VPN App Installs
1,000,000+ | 4.3 star rating
Intrusive App Permissions
- ACCESS_COARSE_LOCATION
- ACCESS_FINE_LOCATION
- READ_EXTERNAL_STORAGE
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
Leaks
No leaks
Dangerous Functions/Behaviors
- java/lang/Runtime;->exec | Execute system command
- LocationManager;->getLastKnownLocation | Get last known location
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- TelephonyManager;->getSimSerialNumber | Get SIM serial number
Virus Test Positives
- Babable: PUP.HighConfidence
Network Test Results
- Major abnormalities: 0
- Minor aberrations: 2
VPN 360 – Unlimited Free VPN Proxy
VPN Details
VPN Developer: TouchVPN Inc.
APK file name: co.infinitysoft.vpn360
VPN App Installs
1,000,000+ | 4.5 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Functions/Behaviors
None
Virus Test Positives
None
Network Test Results
Blocks test traffic
Read our full VPN 360 review.
Free Unlimited VPN Proxy: VPNhub – Safely Hide IP
VPN Details
VPN Developer: AppAtomic Limited
APK file name: com.appatomic.vpnhub
VPN App Installs
1,000,000+ | 4.4 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Functions/Behaviors
- LocationManager;->getLastKnownLocation | Get last known location
- java/lang/Runtime;->exec | Execute system command
Virus Test Positives
None
Network Test Results
- Major abnormalities: 0
- Minor aberrations: 3
VPN Provider Response
The VPNHub developers provided the following response:
“We couldn’t find any reference to location services in vpnhub. Neither in the code, nor in the manifest file via permissions.”
Our view is that the developer has provided their response in good faith, however scans of the latest version of the app (1.4.1) reveal that the app still does contain the risky functions. It’s important to note that there are no permissions currently included in the app that would permit any intrusions of privacy via these functions. However, as we have stated with all apps with similar findings, there is no guarantee that this won’t change with future updates to the app and that it’s better to remove them entirely.
VPN super free proxy master unblock sites
VPN Details
VPN Developer: SHSApps
APK file name: com.baaghidevelopers.proxy.vpn
VPN App Installs
1,000,000+ | 4.2 star rating
Intrusive App Permissions
- ACCESS_COARSE_LOCATION
- ACCESS_FINE_LOCATION
- WRITE_EXTERNAL_STORAGE
Leaks
- IP leak
- WebRTC leak
- DNS leak
Dangerous Functions/Behaviors
- LocationManager;->getLastKnownLocation | Get last known location
Virus Test Positives
None
Network Test Results
- Major abnormalities: 0
- Minor aberrations: 1
Browsec VPN – Free and Unlimited VPN
VPN Details
VPN Developer: Browsec LLC
APK file name: com.browsec.vpn
VPN App Installs
1,000,000+ | 4.6 star rating
Intrusive App Permissions
- READ_CONTACTS
Leaks
No leaks
Dangerous Functions/Behaviors
None
Virus Test Positives
None
Network Test Results
- Major abnormalities: 1
- Minor aberrations: 1
Free & Premium VPN – FinchVPN
VPN Details
VPN Developer: Finch Technology Enterprises
APK file name: com.finchvpn.android
VPN App Installs
1,000,000+ | 4.2 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Functions/Behaviors
None found
Virus Test Positives
None
Network Test Results
- Major abnormalities: 3
- Minor aberrations: 6
Speedify – Bonding VPN
VPN Details
VPN Developer: Connectify Inc.
APK file name: com.speedify.speedifyandroid
VPN App Installs
1,000,000+ | 4.0 star rating
Intrusive App Permissions
- ACCESS_COARSE_LOCATION
- READ_PHONE_STATE
Leaks
None
Dangerous Functions/Behaviors
- java/lang/Runtime;->exec | Execute system command
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- TelephonyManager;->getLine1Number | Get phone number
Virus Test Positives
None
Network Test Results
- Major abnormalities: 0
- Minor aberrations: 8
VPN Provider Response
Speedify responded very quickly and in detail. Summary as follows:
- WRITE_SETTINGS – used in Android 6.0.0 to deal with a very specific network state bug in that version only that caused battery drain.
- READ_PHONE_STATE – gets cellular network name to show in the user interface. It may also be used to create a unique, one-way hash for the user to allow them to use the app without logging in. Optional permission, app works fine without it.
- ACCESS_COARSE_LOCATION – gets city-level location to connect to closest server. They have servers in 70+ locations and they state performance is much better when using closest server. Optional permission at runtime. App works fine without it but may not connect to most optimal server.
- java/lang/Runtime;->exec is used to gather the crash reports from the user’s system (via ‘logcat -b crash’) when they select Help > Generate Log File.
- TelephonyManager;->getDeviceId – creates a unique one-way hash for the user that allows them to anonymously get the 5GB per month from Speedify. “We need to find some kind of unique ID that the user has granted us permission to view. So we try to pull fields from the TelephonyManager (which is only accessible if they granted the optional READ_PHONE_STATE permission) and ANDROID_ID (via ContentResolver) to find something we can hash. This is to allow users to freely and anonymously use the app without having to register.”
- TelephonyManager;->getLine1Number – “We don’t want the phone number; thanks for that find! We just found that and pulled it. Trying to get a new release out tonight with that fix.”
Our view is that these are legitimate and privacy-friendly uses of these permissions and functions. While we don’t support use of location tracking even for server selection optimisation, the fact that this is an optional permission at runtime mitigates the issue. We were impressed at this provider’s willingness to engage with our findings and quickly remove any unnecessary risky functions.
Hotspot VPN – Super Free VPN Unlimited Proxy
VPN Details
VPN Developer: Hotspot VPN( Proxy & Security )
APK file name: com.supervpn.freevpn
VPN App Installs
1,000,000+ | 4.6 star rating
Intrusive App Permissions
- ACCESS_FINE_LOCATION
- CAMERA
- ACCESS_COARSE_LOCATION
- BLUETOOTH
- WRITE_EXTERNAL_STORAGE
- RECORD_AUDIO
Leaks
No leaks
Dangerous Functions/Behaviors
- LocationManager;->getLastKnownLocation | Get last known location
- PowerManager;->reboot | Reboot phone
- TelephonyManager;->getLine1Number | Get phone number
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- TelephonyManager;->getSimSerialNumber | Get SIM serial number
- SmsManager;->sendTextMessage | Send normal SMS
- ActivityManager;->killBackgroundProcesses | Kill processes like AV
- java/lang/Runtime;->exec | Execute system command
Virus Test Positives
None
Network Test Results
Blocks test traffic
Solo VPN – One Tap Free Proxy
VPN Details
VPN Developer: SoloVPN & NCleaner – Notification Cleaner Productivity
APK file name: co.solovpn
VPN App Installs
1,000,000+ | 4.4 star rating
- READ_PHONE_STATE
Leaks
No leaks
Dangerous Functions/Behaviors
- LocationManager;->getLastKnownLocation | Get last known location
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
Virus Test Positives
None
Network Test Results
- Major abnormalities: 0
- Minor aberrations: 5
VPN Proxy by Hexatech – Secure VPN & Unlimited VPN
VPN Details
VPN Developer: Betternet LLC
APK file name: tech.hexa
VPN App Installs
1,000,000+ | 4.3 star rating
None
Leaks
No leaks
Dangerous Functions/Behaviors
None
Virus Test Positives
None
Network Test Results
- Major abnormalities: 2
- Minor aberrations: 8
SkyVPN – Best Free VPN Proxy for Secure WiFi Hotspot
VPN Details
VPN Developer: Sentry SkyVPN Security Team
APK file name: me.skyvpn.app
VPN App Installs
1,000,000+ | 4.6 star rating
- ACCESS_COARSE_LOCATION
- ACCESSS_FINE_LOCATION
- CAMERA
- READ_CALENDAR
- READ_PHONE_STATE
- WRITE_CALENDAR
- WRITE_EXTERNAL_STORAGE
Leaks
No leaks
Dangerous Functions/Behaviors
- LocationManager;->getLastKnownLocation | Get last known location
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- Camera;->open | Open camera
- java/lang/Runtime;->exec | Execute system command
- TelephonyManager;->getLine1Number | Get phone number
- TelephonyManager;->getSimSerialNumber | Get SIM serial number
Virus Test Positives
None
Network Test Results
- Major abnormalities: 0
- Minor aberrations: 2
Read our full Sky VPN review.
LinkVPN Free VPN Proxy
VPN Details
VPN Developer: FuryWeb Tech
APK file name: org.furyweb.linkvpn
VPN App Installs
1,000,000+ | 4.5 star rating
Intrusive App Permissions
- ACCESS_COARSE_LOCATION
- ACCESS_FINE_LOCATION
- READ_PHONE_STATE
- READ_EXTERNAL_STORAGE
- WRITE_EXTERNAL_STORAGE
Leaks
- DNS leak
Dangerous Functions/Behaviors
- LocationManager;->getLastKnownLocation | Get last known location
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- java/lang/Runtime;->exec | Execute system command
Virus Test Positives
None
Network Test Results
- Major abnormalities: 0
- Minor aberrations: 1
VPN Unblocker Free unlimited Best Anonymous Secure
VPN Details
VPN Developer: Royal Partner Company
APK file name: com.unlockme.vpn
VPN App Installs
1,000,000+ | 4.2 star rating
Intrusive App Permissions
- WRITE_EXTERNAL_STORAGE
Leaks
No leaks
Dangerous Functions/Behaviors
None
Virus Test Positives
None
Network Test Results
- Major abnormalities: 0
- Minor aberrations: 1
FREE VPN – Unseen Online
VPN Details
VPN Developer: FREE VPN – Unseen Online
APK file name: com.unseenonline
VPN App Installs
1,000,000+ | 4.5 star rating
Intrusive App Permissions
None
Leaks
- DNS leak
Dangerous Functions/Behaviors
None
Virus Test Positives
None
Network Test Results
- Major abnormalities: 0
- Minor aberrations: 1
GeckoVPN Free Fast Unlimited Proxy VPN
VPN Details
VPN Developer: Best Free VPN Proxy
APK File name: org.geckonet.gecko
VPN App Installs
1,000,000+ | 4.5 star rating
Intrusive App Permissions
- ACCESS_COARSE_LOCATION
- ACCESS_FINE_LOCATION
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
- READ_EXTERNAL_STORAGE
Leaks
- DNS leak
Dangerous Functions/Behaviors
- LocationManager;->getLastKnownLocation | Get last known location
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- java/lang/Runtime;->exec | Execute system command
Virus Test Positives
None
Network Test Results
- Major abnormalities: 0
- Minor aberrations: 4
Easy VPN – Free VPN proxy master, super VPN shield
VPN Details
VPN Developer: Hotspot VPN( Proxy & Security )
APK file name: easyvpn.free.vpn.unblock.proxy
VPN App Installs
1,000,000+ | 4.6 star rating
Intrusive App Permissions
- READ_EXTERNAL_STORAGE
Leaks
- DNS leak
Dangerous Functions/Behaviors
- LocationManager;->getLastKnownLocation | Get last known location
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- TelephonyManager;->getLine1Number | Get phone number
- TelephonyManager;->getSimSerialNumber | Get SIM serial number
- SmsManager;->sendTextMessage | Send normal sms
- ActivityManager;->killBackgroundProcesses | Kill process like AV
- java/lang/Runtime;->exec | Execute system command
Virus Test Positives
- ESET-NOD32: a variant of Android/DataCollector.Utilcode.A
- Symantec Mobile Insight: AdLibrary:Generisk
- Ikarus: PUA.AndroidOS.DataCollector
Network Test Results
Blocks test traffic
VPN Easy – best free proxy
VPN Details
VPN Developer: ZPN
APK file name: free.vpn.proxy.unblock.android.easy.app
VPN App Installs
1,000,000+ | 4.5 star rating
Intrusive App Permissions
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
- READ_EXTERNAL_STORAGE
Leaks
No leaks
Dangerous FunctionsBehaviors
- Camera;->open | Open camera
Virus Test Positives
- Fortinet: Adware/AdColony!Android
Network Test Results
- Major abnormalities: 0
- Minor aberrations: 1
Secure VPN – Free VPN Proxy, Best & Fast Shield
VPN Details
VPN Developer: Hotspot VPN( Proxy & Security )
APK file name: free.vpn.unblock.proxy.securevpn
VPN App Installs
1,000,000+ | 4.6 star rating
Intrusive App Permissions
- READ_EXTERNAL_STORAGE
Leaks
- DNS leak
Dangerous Functions/Behaviors
None
Virus Test Positives
- ESET-NOD32: a variant of Android/DataCollector.Utilcode.A
- Ikarus: PUA.AndroidOS.DataCollector
- Symantec Mobile Insight: AdLibrary:Generisk
- Cyren: AndroidOS/GenPua.0D3DE005!Olympus
Network Test Results
Blocks test traffic
Free VPN Proxy – ZPN
VPN Details
VPN Developer: ZPN
APK file name: im.zpn
VPN App Installs
1,000,000+ | 4.3 star rating
None
Leaks
No leaks
Dangerous Functions/Behaviors
None
Virus Test Positives
None
Network Test Results
Blocks test traffic
VPN Unblock Bokep Sites
VPN Details
VPN Developer: Vpn Internet
APK file name: vpn.bokep.buka.blokir.internet.positif
VPN App Installs
1,000,000+ | 4.1 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Functions/Behaviors
- Camera;->open | Open camera
- LocationManager;->getLastKnownLocation | Get last known location
Virus Test Positives
None
Network Test Results
- Major abnormalities: 1
- Minor aberrations: 7
VPN Over DNS Tunnel : SlowDNS
VPN Details
VPN Developer: TunnelGuru
APK file name: com.in.troiddns
VPN App Installs
1,000,000+ | 4.6 star rating
Intrusive App Permissions
- ACCESS_FINE_LOCATION
- READ_EXTERNAL_STORAGE
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
Leaks
No leaks
Dangerous Functions/Behaviors
- LocationManager;->getLastKnownLocation | Get last known location
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- TelephonyManager;->getSimSerialNumber | Get SIM serial number
- java/lang/Runtime;->exec | Execute system command
Virus Test Positives
- Babable: PUP.HighConfidence
Network Test Results
- Major abnormalities: 1
- Minor aberrations: 9
See full network test results.
Best VPN Proxy OvpnSpider
VPN Details
VPN Developer: WCOMES TECHNOLOGIES CO.,LIMITED
APK file name: com.ovpnspider
VPN App Installs
1,000,000+ | 4.1 star rating
Intrusive App Permissions
- ACCESS_FINE_LOCATION
- ACCESS_COARSE_LOCATION
- WRITE_EXTERNAL_STORAGE
Leaks
- DNS Leak
Dangerous Functions/Behaviors
- LocationManager;->getLastKnownLocation | Get last known location
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- TelephonyManager;->getSimSerialNumber | Get SIM serial number
- java/lang/Runtime;->exec | Execute system command
Virus Test Positives
- Cyren: AndroidOS/GenPUA.FC71B244!Olympus
- ESET-NOD32: a variant of Android/Packed.TencentProtect.B potentially unsafe
- Ikarus: Adware.AndroidOS.TencentProtect
Network Test Results
- Major abnormalities: 0
- Minor aberrations: 4
See full network test results.
VPN Unlimited Proxy AppVPN
VPN Details
VPN Developer: WCOMES TECHNOLOGIES CO.,LIMITED
APK file name: appvpn.vpn
VPN App Installs
1,000,000+ | 4.1 star rating
- WRITE_EXTERNAL_STORAGE
Leaks
No leaks
Dangerous Functions/Behaviors
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- java/lang/Runtime;->exec | Execute system command
Virus Test Positives
- Cyren: AndroidOS/GenPUA.FC71B244!Olympus
- ESET-NOD32: a variant of Android/Packed.TencentProtectB
- Ikarus: Adware.AndroidOS.TencentProtect
- Qihoo-360: Trojan.Android.Gen
- TrendMicro-HouseCall: Suspicious_GEN.F47V0830
Network Test Results
- Major abnormalities: 0
- Minor aberrations: 2
See full network test results.
WhatsVPN – Unlimited Free VPN
VPN Details
VPN Developer: Unlimited DT Security Studio
APK file name: com.infvpn.turbo.free.proxy.whatsvpn
VPN App Installs
1,000,000+ | 4.7 star rating
Intrusive App Permissions
- ACCESS_COARSE_LOCATION
- ACCESS_FINE_LOCATION
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
Leaks
No leaks
Dangerous Functions/Behaviors
- LocationManager;->getLastKnownLocation | Get last known location
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
Virus Test Positives
None
Network Test Results
Blocks test traffic
VPN Proxy Master – free unblock VPN & security VPN
VPN Details
VPN Developer: Innovative Connecting
APK file name: free.vpn.unblock.proxy.vpn.master.pro
VPN App Installs
1,000,000+ | 4.7 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Functions/Behaviors
- LocationManager;->getLastKnownLocation | Get last known location
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- java/lang/Runtime;->exec | Execute system command
Virus Test Positives
- Babable: PUP.HighConfidence
Network Test Results
Blocks test traffic
Read our full VPN Proxy Master review.
Amaze VPN (Free VPN Proxy)
VPN Details
VPN Developer: FreeVPN
APK file name: free.unblock.vpnpro
VPN App Installs
1,000,000+ | 4.5 star rating
Intrusive App Permissions
- READ_PHONE_STATE
- READ_EXTERNAL_STORAGE
- WRITE_EXTERNAL_STORAGE
Leaks
No leaks
Dangerous Functions/Behaviors
None found
Virus Test Positives
- Trustlook: Android.Malware.General (score:9)
Network Test Results
- Major abnormalities: 1
- Minor aberrations: 5
- READ_EXTERNAL_STORAGE
- WRITE_EXTERNAL_STORAGE
- LocationManager;->getLastKnownLocation | Get last known location
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- Major abnormalities: 1
- Minor aberrations: 3
- LocationManager;->getLastKnownLocation | Get last known location
- java/lang/Runtime;->exec | Execute system command
- Major abnormalities: 0
- Minor aberrations: 1
- LocationManager;->getLastKnownLocation – “Location access is a runtime permission that’s requested if the user wants to take advantage of the network whitelisting functionality, as it’s required to read Wifi SSID and cellular network APN on newer versions of Android. We don’t use any physical location APIs, as those are pointless for our purposes. This permission is optional and does not need to be granted for the app to work, but network whitelisting will not work.“
- java/lang/Runtime;->exec is used to run the Stunnel library, which is a separate process that provides openvpn tunnel encapsulation.
- LocationManager;->getLastKnownLocation | Get last known location
- java/lang/Runtime;->exec | Execute system command
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- ActivityManager;->killBackgroundProcesses | Kill process like AV
- ActivityManager;->restartPackage | Kill process like AV
- Babable: PUP.HighConfidence
- Major abnormalities: 1
- Minor aberrations: 4
- ACCESS_COARSE_LOCATION
- ACCESS_FINE_LOCATION
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
- READ_EXTERNAL_STORAGE
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- java/lang/Runtime;->exec | Execute system command
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
- DNS leak
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- LocationManager;->getLastKnownLocation | Get last known location
- K7GW: Adware ( 0052b8661 )
- WRITE_EXTERNAL_STORAGE
- READ_PHONE_STATE
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- LocationManager;->getLastKnownLocation | Get last known location
- TelephonyManager;->getLine1Number | Get phone number
- ActivityManager;->killBackgroundProcesses | Kill process like AV
- Cyren: AndroidOS/GenGl.FEAFC1A!Olympus
- Symantec Mobile Insight: AppRIsk:Generisk
- Major abnormalities: 0
- Minor aberrations: 4
- READ_PHONE_STATE
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- LocationManager;->getLastKnownLocation | Get last known location
- Major abnormalities: 0
- Minor aberrations: 3
- ACCESS_COARSE_LOCATION
- ACCESS_FINE_LOCATION
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
- READ_EXTERNAL_STORAGE
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- LocationManager;->getLastKnownLocation | Get last known location
- Major abnormalities: 0
- Minor aberrations: 2
- LocationManager;->getLastKnownLocation & TelephonyManager;->getDeviceId – Hideman pointed out that their app doesn’t ask for any permissions when it runs so they can’t access SMS or location. They stated that LocationManager was “only used by Firebase Ads library”.
- READ_PHONE_STATE – this was used in previous versions of the app to enable the function above to read the device ID, albeit in hashed form “which means that it is almost impossible to recover the real device identifier”. They say that this is no longer used.
- ACCESS_COARSE_LOCATION
- ACCESS_FINE_LOCATION
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
- LocationManager;->getLastKnownLocation | Get last known location
- READ_EXTERNAL_STORAGE
- ESET-NOD32: a variant of Android/DataCollector.Utilcode.A potentially unsafe
- ACCESS_FINE_LOCATION
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
- READ_EXTERNAL_STORAGE
- LocationManager;->getLastKnownLocation | Get last known location
- Major abnormalities: 0
- Minor aberrations: 3
- ACCESS_FINE_LOCATION is used for “advertising and location detection purposes to select servers”.
- WRITE_EXTERNAL_STORAGE is used for “advertising and caching data”.
- READ_PHONE_STATE is used to automatically pause or restart VPN connections when making calls or sending SMS, and to detect network (ie 3G or 4G).
- LocationManager->getLastKnownLocation is used for “advertising and location detection purposes to select servers”.
- ContentResolver;->query is present as a result of 3rd party libraries. While the developer stated it was not used for reading user SMS, they failed to provide any further info.
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
- READ_EXTERNAL_STORAGE
- Trustlook: Android.Malware.General (score:9)
- Major abnormalities: 0
- Minor aberrations: 4
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
- DNS leak
- Trustlook: Android.Malware.General (score:9)
- DNS leak
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
- DNS leak
- WRITE_EXTERNAL_STORAGE allows users to save a configuration that they can export or share with fellow users.
- “For the rest of the stuff , they may be coming from Google SDK, we have no need for users sms or location.”
- READ_PHONE_STATE
- ACCESS_COARSE_LOCATION
- WRITE_EXTERNAL_STORAGE
- Major abnormalities: 0
- Minor aberrations: 1
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
- LocationManager;->getLastKnownLocation | Get last known location
- TelephonyManager;->getLine1Number | Get phone number
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- java/lang/Runtime;->exec | Execute system command
- Major abnormalities: 0
- Minor aberrations: 2
- java/lang/Runtime;->exec | Execute system command
- Major abnormalities: 1
- Minor aberrations: 4
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
- READ_EXTERNAL_STORAGE
- DNS leak
- ESET-NOD32: a variant of Android/Packed.TencentProtect.B potentially unsafe
- K7GW: Adware ( 0052b8671 )
- Symantec Mobile Insight: AdLibrary: Generisk
- Major abnormalities: 1
- Minor aberrations: 7
- READ_PHONE_STATE is used by a third-party mobile analytics platform (from Chinese company Umeng) to identify a device and complete app usage stats.
- WRITE_EXTERNAL_STORAGE & READ_EXTERNAL_STORAGE is used to enable this VPN’s approach to user registration and incentivisation. Users are awarded coins for actions like sharing the VPN with friends that unlock additional servers. This permission allows storage of data relating to coins and associated user ID to avoid its loss in the event of reinstallation. This is optional.
- ACCESS_COARSE_LOCATION
- ACCESS_FINE_LOCATION
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
- DNS leak
- LocationManager;->getLastKnownLocation | Get last known location
- ACCESS_COARSE_LOCATION
- ACCESS_FINE_LOCATION
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
- LocationManager;->getLastKnownLocation | Get last known location
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- TelephonyManager;->getSimSerialNumber | Get SIM serial number
- java/lang/Runtime;->exec | Execute system command
- Major abnormalities: 2
- Minor aberrations: 4
- ACCESS_COARSE_LOCATION
- ACCESS_FINE_LOCATION
- BLUETOOTH
- Major abnormalities: 2
- Minor aberrations: 8
- SEND_SMS
- READ_PHONE_STATE
- ACCESS_COARSE_LOCATION
- WRITE_EXTERNAL_STORAGE
- DNS leak
- Major abnormalities: 3
- Minor aberrations: 6
- Major abnormalities: 2
- Minor aberrations: 6
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
- Trustlook: Android.Malware.General (score:9) 20181130
- Major abnormalities: 2
- Minor aberrations: 6
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
- DNS leak
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- LocationManager;->getLastKnownLocation | Get last known location
- K7GW: Adware ( 0052b8661 ) 20181129
- Major abnormalities: 1
- Minor aberrations: 4
- LocationManager;->getLastKnownLocation | Get last known location
- java/lang/Runtime;->exec | Execute system command
- Camera;->open | Open camera
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- ContentResolver;->query – “We are using it to get the unique random Android Application ID that is generated uniquely to each combination of app-signing key, user, and device (randomized). This value is being regenerated upon application install / uninstall and does not identify the users or any private information, at any case. We use it to prevent abuse of our free trial without credit card registration.”
- LocationManager;->getLastKnownLocation – “We didn’t find any reference to the LocationManager within our source code or tracking the geo location of our users.”
- java/lang/Runtime;->exec – “We store debug logs locally on the device. The logs are needed to be extracted and sent manually by the user in some cases that required upon support request. The logs are generic service logs that are helping our support to address some cases.”
- Camera;->open – “We previously had the option to scan the credit card to make it easier to purchase the VPN subscription. We removed it due to privacy concerns of utilizing the camera and removed the meta permissions required by the user. This feature was disabled and is not being used / executed. It is important to stress that Camera permissions are not enabled / asked to be given by the users so even if the code is executed somehow it will throw and exception because of the missing permissions. Again, the code and the credit card camera scanning is disabled over a year now which is meaningless.”
- TelephonyManager;->getDeviceId – “We don’t use the getDeviceId method — would appreciate if you can send over the test report that points it out so we could address it better. However we do use the method getSimCountryIso to select the closest VPN location for the user as default. The information is not being sent to the servers side and is being used only internally within the app to select the default VPN location in ease.”
- READ_PHONE_STATE
- BLUETOOTH
- WRITE_EXTERNAL_STORAGE
- LocationManager;->getLastKnownLocation | Get last known location
- Telephony Manager;->getDeviceId | Get info like IMEI, phone number or OS version
- java/lang/Runtime;->exec | Execute system command
- READ_EXTERNAL_STORAGE
- Major abnormalities: 1
- Minor aberrations: 4
- None found
- Babable: PUP.HighConfidence
- CAT-QUickHeal: Android.Wapron.GEN24505 (PUP)
- ESET-NOD32: a variant of Android/Packed.Jiagu.D
- Ikarus: PUA.AndroidOS.Jiagu
- K7GW: Trojan ( 005259891 )
- Symantec Mobile Insight: AdLibrary:Generisk
- Major abnormalities: 0
- Minor aberrations: 1
- ACCESS_FINE_LOCATION
- READ_PHONE_STATE
- ACCESS_COARSE_LOCATION
- WRITE_EXTERNAL_STORAGE
- LocationManager;->getLastKnownLocation | Get last known location
- Major abnormalities: 0
- Minor aberrations: 6
- READ_PHONE_STATE
- BLUETOOTH
- WRITE_EXTERNAL_STORAGE
- Major abnormalities: 0
- Minor aberrations: 3
- DNS leak
- LocationManager;->getLastKnownLocation | Get last known location
- java/lang/Runtime;->exec | Execute system command
- Major abnormalities: 2
- Minor aberrations: 5
- DNS leak
- IP leak
- WebRTC leak
- Major abnormalities: 0
- Minor aberrations: 3
- READ_EXTERNAL_STORAGE
- DNS leak
- DNS leak
- Major abnormalities: 0
- Minor aberrations: 2
- Major abnormalities: 0
- Minor aberrations: 5
- SEND_SMS
- READ_CONTACTS
- WRITE_EXTERNAL_STORAGE
- ContentResolver;->query | Read database like contact or sms
- PowerManager;->reboot | Reboot cellphone
- LocationManager;->getLastKnownLocation | Get last known location
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- TelephonyManager;->getSimSerialNumber | Get SIM serial number
- TelephonyManager;->getLine1Number | Get phone number
- SmsManager;->sendTextMessage | Send normal sms
- ActivityManager;->killBackgroundProcesses | Kill process like AV
- java/lang/Runtime;->exec | Execute system command
- Major abnormalities: 0
- Minor aberrations: 2
- WRITE_EXTERNAL_STORAGE
- DNS leak
- LocationManager;->getLastKnownLocation | Get last known location
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- java/lang/Runtime;->exec | Execute system command
- READ_EXTERNAL_STORAGE
- DNS leak
- LocationManager;->getLastKnownLocation | Get last known location
- java/lang/Runtime;->exec | Execute system command
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
- ACCESS_FINE_LOCATION
- READ_EXTERNAL_STORAGE
- WRITE_EXTERNAL_STORAGE
- LocationManager;->getLastKnownLocation | Get last known location
- Major abnormalities: 1
- Minor aberrations: 3
- LocationManager;->getLastKnownLocation | Get last known location
- Major abnormalities: 0
- Minor aberrations: 5
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
- LocationManager;->getLastKnownLocation | Get last known location
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- java/lang/Runtime;->exec | Execute system command
- AegisLab: Trojan.AndroidOS.Generic.C!c
- LocationManager;->getLastKnownLocation | Get last known location
- ACCESS_FINE_LOCATION
- WRITE_EXTERNAL_STORAGE
- ACCESS_COARSE_LOCATION
- LocationManager;->getLastKnownLocation | Get last known location
- ACCESS_COARSE_LOCATION
- ACCESS_FINE_LOCATION
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
- READ_EXTERNAL_STORAGE
- DNS leak
- LocationManager;->getLastKnownLocation | Get last known location
- READ_PHONE_STATE
- LocationManager;->getLastKnownLocation | Get last known location
- Major abnormalities: 2
- Minor aberrations: 6
- ACCESS_FINE_LOCATION
- WRITE_EXTERNAL_STORAGE
- ACCESS_COARSE_LOCATION
- LocationManager;->getLastKnownLocation | Get last known location
- ACCESS_COARSE_LOCATION
- BLUETOOTH
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
- LocationManager;->getLastKnownLocation | Get last known location
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- Major abnormalities: 0
- Minor aberrations: 6
- WRITE_EXTERNAL_STORAGE
- READ_EXTERNAL_STORAGE
- DNS leak
- LocationManager;->getLastKnownLocation | Get last known location
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- TelephonyManager;->getLine1Number | Get phone number
- java/lang/Runtime;->exec | Execute system command
- WRITE_EXTERNAL_STORAGE
- READ_EXTERNAL_STORAGE
- DNS leak
- LocationManager;->getLastKnownLocation | Get last known location
- Major abnormalities: 0
- Minor aberrations: 3
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
- LocationManager;->getLastKnownLocation | Get last known location
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- java/lang/Runtime;->exec | Execute system command
- WRITE_EXTERNAL_STORAGE
- READ_EXTERNAL_STORAGE
- DNS leak
- Major abnormalities: 0
- Minor aberrations: 4
- LocationManager;->getLastKnownLocation | Get last known location
- Major abnormalities: 0
- Minor aberrations: 2
- LocationManager;->getLastKnownLocation | Get last known location
- Major abnormalities: 0
- Minor aberrations: 4
- WRITE_EXTERNAL_STORAGE
- LocationManager;->getLastKnownLocation | Get last known location
- Camera;->open | Open camera
- Major abnormalities: 0
- Minor aberrations: 4
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
- READ_EXTERNAL_STORAGE
- LocationManager;->getLastKnownLocation | Get last known location
- java/lang/Runtime;->exec | Execute system command
- LocationManager;->getLastKnownLocation – the dev state it they do not use this explicitly and that while it may be part of a third-party library, the necessary permission is not part of the app.
- java/lang/Runtime;->exec is used call ping command to test the servers’ latency.
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
- DNS leak
- Babable: PUP.HighConfidence 20180918
- CAT-QuickHeal: Android.Wapron.GEN24505 (PUP) 20181130
- Cyren: AndroidOS/GenPua.6E4D6FAC!Olympus 20181130
- ESET-NOD32: a variant of Android/Packed.Jiagu.D potentially unsafe 20181130
- K7GW: Trojan ( 0053576b1 ) 20181130
- Symantec Mobile Insight: AdLibrary:Generisk 20181121
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
- ACCESS_FINE_LOCATION
- ACCESS_COARSE_LOCATION
- Major abnormalities: 1
- Minor aberrations: 5
- WRITE_EXTERNAL_STORAGE
- Major abnormalities: 1
- Minor aberrations: 2
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
- Trustlook: Android.Malware.General (score:9)
- Major abnormalities: 0
- Minor aberrations: 5
- LocationManager;->getLastKnownLocation | Get last known location
- Major abnormalities: 0
- Minor aberrations: 3
- WRITE_EXTERNAL_STORAGE allows users to save a configuration that they can export or share with fellow users.
- “For the rest of the stuff , they may be coming from Google SDK, we have no need for users sms or location.”
- Major abnormalities: 0
- Minor aberrations: 5
- READ_EXTERNAL_STORAGE
- LocationManager;->getLastKnownLocation | Get last known location
- Major abnormalities: 0
- Minor aberrations: 3
- None found
- READ_PHONE_STATE
- DNS leak
- Major abnormalities: 1
- Minor aberrations: 5
- WRITE_EXTERNAL_STORAGE
- None found
- Major abnormalities: 1
- Minor aberrations: 7
- Major abnormalities: 1
- Minor aberrations: 6
- WRITE_EXTERNAL_STORAGE
- LocationManager;->getLastKnownLocation | Get last known location
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- java/lang/Runtime;->exec | Execute system command
- Major abnormalities: 1
- Minor aberrations: 4
- LocationManager;->getLastKnownLocation & TelephonyManager;->getDeviceId are present due ad networks being used. They provided examples of networks being used: AdMob (Google), AppBrain, InMobi, IronSource, Vungle, UnityAds, AyetStudios, Tappx. However due to the lack of necessary permissions, these functions are not able to successfully execute. The dev stated they plan to reduce the use of ad networks in their next release.
- java/lang/Runtime;->exec – the dev states the only functions in this class are calls for memory and processors.
- LocationManager;->getLastKnownLocation | Get last known location
- Major abnormalities: 3
- Minor aberrations: 4
- LocationManager;->getLastKnownLocation | Get last known location
- READ_CONTACTS
- Babable: PUP.HighConfidence
- CAT-QuickHeal: Android.Wapron.GEN24505
- Cyren: AndroidOS/GenPua.5923C3D0!Olympus
- ESET-NOD32: a variant of Android/Packed.Jiagu.D
- Ikarus: PUA.AndroidOS.Jiagu
- K7GW: Trojan ( 005259891 )
- Symantec Mobile Insight: AdLibrary:Generisk
- Major abnormalities: 0
- Minor aberrations: 1
- Babable: PUP.HighConfidence
- CAT-QuickHeal: Android.Wapron.GEN24505
- Cyren: AndroidOS/GenPua.5923C3D0!Olympus
- ESET-NOD32: a variant of Android/Packed.Jiagu.D
- Ikarus: PUA.AndroidOS.Jiagu
- K7GW: Trojan ( 005259891 )
- Symantec Mobile Insight: AdLibrary:Generisk
- Major abnormalities: 0
- Minor aberrations: 2
- LocationManager;->getLastKnownLocation | Get last known location
- Major abnormalities: 0
- Minor aberrations: 1
- LocationManager;->getLastKnownLocation | Get last known location
- java/lang/Runtime;->exec | Execute system command
- ActivityManager;->killBackgroundProcesses | Kill process like AV
- Major abnormalities: 0
- Minor aberrations: 7
- ACCESS_COARSE_LOCATION
- ACCESS_FINE_LOCATION
- WRITE_EXTERNAL_STORAGE
- LocationManager;->getLastKnownLocation | Get last known location
- LocationManager;->getLastKnownLocation | Get last known location
- LocationManager;->getLastKnownLocation | Get last known location
- CAMERA
- WRITE_EXTERNAL_STORAGE
- LocationManager;->getLastKnownLocation | Get last known location
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- Camera;->open | Open camera
- Major abnormalities: 1
- Minor aberrations: 4
- READ_PHONE_STATE
- java/lang/Runtime;->exec | Execute system command
- Major abnormalities: 0
- Minor aberrations: 2
- LocationManager;->getLastKnownLocation | Get last known location
- Major abnormalities: 3
- Minor aberrations: 8
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
- LocationManager;->getLastKnownLocation | Get last known location
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- java/lang/Runtime;->exec | Execute system command
- WRITE_EXTERNAL_STORAGE
- DNS leak
- Babable: PUP.HighConfidence 20180918
- CAT-QuickHeal: Android.Wapron.GEN24505 (PUP) 20181205
- ESET-NOD32: a variant of Android/Packed.Jiagu.D potentially unsafe 20181205
- Ikarus: PUA.AndroidOS.Jiagu 20181204
- Symantec Mobile Insight: AdLibrary:Generisk 20181204
- Major abnormalities: 0
- Minor aberrations: 1
- LocationManager;->getLastKnownLocation | Get last known location
- Major abnormalities: 2
- Minor aberrations: 4
- LocationManager;->getLastKnownLocation | Get last known location
- java/lang/Runtime;->exec | Execute system command
- Major abnormalities: 1
- Minor aberrations: 5
- READ_PHONE_STATE
- WRITE_EXTERNAL_STORAGE
- READ_EXTERNAL_STORAGE
- LocationManager;->getLastKnownLocation | Get last known location
- TelephonyManager;->getDeviceId | Get info like IMEI, phone number or OS version
- java/lang/Runtime;->exec | Execute system command
- Major abnormalities: 3
- Minor aberrations: 8
Rocket VPN – Internet Freedom
VPN Details
VPN Developer: Liquidum Limited
APK file name: com.liquidum.rocketvpn
VPN App Installs
1,000,000+ | 4.3 star rating
Intrusive App Permissions
Leaks
No leaks
Dangerous Functions/Behaviors
Virus Test Positives
None
Network Test Results
Windscribe VPN
VPN Details
VPN Developer: Windscribe
APK file name: com.windscribe.vpn.apk
VPN App Installs
1,000,000+ | 4.2 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Functions/Behaviors
Virus Test Positives
None
Network Test Results
VPN Provider Response
The founder of Windscribe provided a swift response, summary as follows:
Our view is that these are perfectly reasonable uses of these functions. Rather than being used for advertising or as a result of a third-party library, the location function is for an optional feature that allows users to whitelist trusted networks. Highly privacy-conscious users will simply ignore that feature. The runtime function is also perfectly legitimate. Due to its freemium model, Windscribe avoids the typical problems associated with ad-supported apps and is among the best services of its kind.
Read our full Windscribe Free review.
Kaspersky VPN
VPN Details
VPN Developer: Kaspersky
APK file name: com.kaspersky.secure.connection.apk
VPN App Installs
1,000,000+ | 4.6 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Functions/Behaviors
Virus Test Positives
Network Test Results
VPN Provider Response
Kaspersky Lab provided us with the following detailed statement:
Kaspersky Lab is aware of concerns that some functions of Kaspersky Secure Connection for Android may pose a danger to user privacy. We would like to assure customers that these functions and behaviors found in the source code of our apps are not intended to compromise users in any way. It is worth noting that the functions below are due to Kaspersky Secure Connection being based upon Kaspersky Mobile SDK (Software Development Kit) and including parts of the anti-virus functionality used in other Kaspersky products.
In relation to the specific functions that were thought to be potentially dangerous:
LocationManager;->getLastKnownLocation
This function is a part android.support.v7 library used for the Dark Mode supporting, which appeared in the latest Android Versions.
java/lang/Runtime;->exec
This function allows the running of the chmod command. Chmod is used to change permissions of the HTML page which a user is redirected to when trying to visit blocked resources. It can’t be initiated from a VPN and will be removed from future versions of the product.
ActivityManager;->killBackgroundProcesses
The function can disable other programs and processes, but it can’t be initiated from a VPN and will be removed from future versions of the product. This feature doesn’t retrieve any confidential information and can’t compromise user privacy.
TelephonyManager;->getDeviceId
This is a unique identifier used to register devices on My Kaspersky (the online service for managing the security of all your devices). With Kaspersky Secure Connection, My Kaspersky is used for product licensing and premium account activation. My Kaspersky allows customers to manage the security of several devices connected to one account – for example, to check and change the protection status of those devices and take other measures to increase their security. Processing of these identifiers is stated in the End User License Agreement.
ActivityManager;->restartPackage
The function can disable other programs and processes. However, it can’t be initiated from a VPN and will be removed from future versions of the product. Additionally, we would like to reassure customers that this feature doesn’t retrieve any confidential information about the user and therefore can’t compromise privacy.
The security of our customers and their privacy remain top priorities for the company. All data collected by our app is stated in the End User License Agreement.
Our view is that it’s commendable that Kaspersky not only provided such a detailed statement but also committed to removing risky functions that are unnecessary for the product. However, we are much less comfortable with the degree of user identification taking place as outlined in the EULA and with the fact that information is shared with the third-party operating the VPN network used by the app (AnchorFree in this instance, the operator of Hotspot Shield). Anyone serious about privacy should really look elsewhere.
Secure Web VPN
VPN Details
VPN Developer: Secure Web
APK file name: com.secureweb
VPN App Installs
500,000+ | 4.3 star rating
Leaks
No leaks
Dangerous Functions/Behaviors
Virus Test Positives
None
Network Test Results
Blocks test traffic
ACT VPN – Unlimited Free VPN & Fast VPN Proxy
VPN Details
VPN Developer: VPN ??
APK file name: com.vpn.kmvpn11
VPN App Installs
500,000+ | 4.6 star rating
Leaks
Dangerous Behaviors / Functions
Virus Test Positives
Network Test Results
Blocks test traffic
GO VPN Proxy Master
VPN Details
VPN Developer: VPNMaster Team
APK file name: free.unblock.proxy.unlimited.vpnmaster
VPN App Installs
500,000+ | 4.5 star rating
Intrusive App Permissions
Leaks
No leaks
Dangerous Behaviors / Functions
Virus Test Positives
Network Test Results
Hideman Free VPN
VPN Details
VPN Developer: Hideman Ltd
APK file name: net.hideman.free
VPN App Installs
500,000+ | 4.1 star rating
Intrusive App Permissions
Leaks
No leaks
Dangerous Behaviors / Functions
Virus Test Positives
None
Network Test Results
MoonVPN Free VPN Unblock Proxy
VPN Details
VPN Developer: MoonRun Tech
APK file name: org.moonrun.moonvpn
VPN App Installs
500,000+ | 4.5 star rating
Intrusive App Permissions
Leaks
No leaks
Dangerous Behaviors / Functions
Virus Test Positives
None
Network Test Results
VPN Provider Response
Hideman provided a swift if brief and transparent response. Summary as follows:
Our view is that while these functions and permissions may “only” have been used for advertising and not actively compromising privacy, they remain risky in nature and open to potential future abuses in the case of app updates or changes in ownership of the app. We also note that it’s only “almost” impossible to recover the real device ID once hashed.
Bestline VPN – Free & Fast & Unlimited & Unblock
VPN Details
VPN Developer: Unlimited DT Security Studio
APK file name: co.bestline.turbo.free.vpn.unblock.proxy
VPN App Installs
500,000+ | 4.6 star rating
Intrusive App Permissions
Leaks
No leaks
Dangerous Behaviors / Functions
Virus Test Positives
None
Network Test Results
Blocks test traffic
Free and Unlimited VPN – Safe, Secure, Private!
VPN Details
VPN Developer: Gibli Mobile
APK file name: com.free_vpn
VPN App Installs
500,000+ | 4.4 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Behaviors / Functions
None found
Virus Test Positives
None
Network Test Results
Blocks test traffic
Hotspot VPN – Free, Unlimited, Fast and Secure
VPN Details
VPN Developer: Hotspot VPN
APK file name: com.hotspotvpn.android
VPN App Installs
500,000+ | 4.1 star rating
Intrusive App Permissions
Leaks
No leaks
Dangerous Behaviors / Functions
None found
Virus Test Positives
Network Test Results
Blocks test traffic
Power VPN Free VPN
VPN Details
VPN Developer: PowerVPN
APK file name: com.vpn.powervpn
VPN App Installs
500,000+ | 4.5 star rating
Intrusive App Permissions
Leaks
No leaks
Dangerous Behaviors / Functions
Virus Test Positives
None
Network Test Results
PowerVPN provided a response that while covering all necessary points was a little lacking in detail. They also stated they were “in process of adding proper clarifications in the VPN for the permissions etc”. Summary as follows:
Our view is that this is a typical example of how free VPN apps so often fail to prioritize user privacy over advertising and ease of development. There is no absolute need to access a user’s GPS data in order to serve them ads for example. None of the above items are critical to the functioning of a VPN and yet all increase the risk to user privacy. Note that we also asked about the GET_TASKS permission, which the developer states they use to track which apps you are using with their VPN. While they may claim not to sell this data to any third-party, we are not comfortable with a VPN app monitoring user behavior in this way.
VPN Provider Resp
EagleVPN – Free.unblock.proxy
VPN Details
VPN Developer: Eagle VPN proxy
APK file name: free.unblock.pro.flashvpn
VPN App Installs
500,000+ | 4.6 star rating
Intrusive App Permissions
Leaks
No leaks
Dangerous Behaviors / Functions
None found
Virus Test Positives
Network Test Results
HotVPN – Free.unblock.fast proxy VPN
VPN Details
VPN Developer: HOTVPN Team
APK file name: free.unblock.proxy.unlimited.hotvpn
VPN App Installs
500,000+ | 4.6 star rating
Intrusive App Permissions
Leaks
Dangerous Behaviors / Functions
None found
Virus Test Positives
Network Test Results
Blocks test traffic
Free VPN – Super Unblock Proxy Master Hotspot VPN
VPN Details
VPN Developer: Super VPN & Free Proxy
APK file name: free.vpn.proxy.unblock.svd
VPN App Installs
500,000+ | 4.4 star rating
Intrusive App Permissions
None
Leaks
Dangerous Behaviors / Functions
None found
Virus Test Positives
None
Network Test Results
Blocks test traffic
Stark VPN
VPN Details
VPN Developer: iStark
APK file name: net.starkvpn.starkvpn
VPN App Installs
500,000+ | 4.2 star rating
Intrusive App Permissions
Leaks
Dangerous Behaviors / Functions
None found
Virus Test Positives
None
Network Test Results
Blocks test traffic
VPN Provider Response
The Stark VPN developers provided a very brief response, which as it was identical to that from Anonytun reveals them to be the same people despite a different developer name, details as follows:
Our view is that this shows – at best – a disturbing lack of knowledge of how their own app works that should give users pause for thought before entrusting them with their internet activity and all the personal data that entails.
Free VPN by FreeVPN.org
VPN Details
VPN Developer: FREE VPN LLC
APK file name: org.freevpn
VPN App Installs
500,000+ | 4.3 star rating
Intrusive App Permissions
Leaks
No leaks
Dangerous Behaviors / Functions
None found
Virus Test Positives
None
Network Test Results
Read our full Free VPN by FreeVPN.org review.
InvinciBull VPN – Safe. Private. Invincible.
VPN Details
VPN Developer: Finjan Mobile, Inc
APK file name: com.finjan.securebrowser
VPN App Installs
500,000+ | 4.4 star rating
Intrusive App Permissions
Leaks
No leaks
Dangerous Behaviors / Functions
Virus Test Positives
None
Network Test Results
Atom VPN (100% free)
VPN Details
VPN Developer: Atomvpn.com
APK file name: com.atom.socks5
VPN App Installs
500,000+ | 4.4 star rating
None
Leaks
No leaks
Dangerous Behaviors / Functions
Virus Test Positives
None
Network Test Results
Wuma VPN-PRO (Fast & Unlimited & Security)
VPN Developer: ??wuma vpn
VPN Details
APK file name: com.muma.pn
VPN App Installs
500,000+ | 4.8 star rating
Intrusive App Permissions
Leaks
Dangerous Behaviors / Functions
None found
Virus Test Positives
Network Test Results
VPN Provider Response
The developers of wuma vpn provided a highly detailed response, summary as follows:
Our view is that while these permissions appear to have been used in good faith, it does not alter the fact that their presence constitutes a privacy risk and that there are more privacy-friendly means to achieve the same goals. However in a positive development, the developer stated, “as you are so concerned and sensitive about these permissions, we will consider removing them after the next version (V4.0).”
VPN Lighter – Free Unlimited VPN
VPN Details
VPN Developer: Sarah Hawken
APK file name: com.yogavpn.free.unblock.ligher.proxy
VPN App Installs
100,000+ total installs | 4.6 star rating
Intrusive App Permissions
Leaks
Dangerous Behaviors / Functions
Virus Test Positives
None
Network Test Results
Blocks test traffic
Hi VPN Pro – Free Unlimited Proxy & Hotspot VPN
VPN Details
VPN Developer: Hi Security
APK file name: com.ehawk.proxy.freevpn.pro
VPN App Installs
100,000+ total installs | 4.5 star rating
Intrusive App Permissions
Leaks
No leaks
Dangerous Behaviors / Functions
Virus Test Positives
None
Network Test Results
Super VPN Hotspot Free Secure VPN Proxy Master
VPN Details
VPN Developer: Tech Insta Lab
APK file name: com.droidmentor.super_vpn_proxy_turbo_master.unblock_site
VPN App Installs
100,000+ total installs | 4.3 star rating
Intrusive App Permissions
Leaks
No leaks
Dangerous Behaviors / Functions
None found
Virus Test Positives
None
Network Test Results
VPN Dog – Free & Fast & Unlimited & Unblock
VPN Details
VPN Developer: Huago
APK file name: com.go.vpndog
VPN App Installs
100,000+ total installs | 4.4 star rating
Intrusive App Permissions
Leaks
Dangerous Behaviors / Functions
None found
Virus Test Positives
None
Network Test Results
FREE VPN – Unlimited Free Fast VPN for Android
VPN Details
VPN Developer: FREE VPN (Unlimited Fast VPN Master)
APK file name: com.open.hotspot.vpn.free
VPN App Installs
100,000+ total installs | 4.5 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Behaviors / Functions
None found
Virus Test Positives
None
Network Test Results
Unlimited Free VPN Proxy By Hello VPN
VPN Details
VPN Developer: appmobyu
APK file name: free.unblock.hellovpn
VPN App Installs
100,000+ | 4.5 star rating
Intrusive App Permissions
Leaks
No leaks
Dangerous Functions/Behaviors
None
Virus Test Positives
Network Test Results
AIR VPN – Free VPN Proxy Best & Fast Shield
VPN Details
VPN Developer: free vpn proxy
APK file name: com.vpn.tianxing.vpn
VPN App Installs
100,000+ | 4.7 star rating
Intrusive App Permissions
Leaks
Dangerous Functions/Behaviors
Virus Test Positives
Network Test Results
Free VPN Proxy & WiFi Security – SaferVPN
VPN Details
VPN Developer: Safer Social Ltd
APK file name: com.safervpn.android
VPN App Installs
100,000 | 4.4 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Functions/Behaviors
Virus Test Positives
None
Network Test Results
Blocks test traffic
VPN Provider Response
After initially failing to provide any information, the developers (Safer Social Ltd) did send us a very detailed response, which is summarised as follows:
Our view is that while the level of detail provided is a positive, we remain unconvinced about the safety of this app. Scans of the latest version of the app (4.1.11) show that while the camera permission has been removed, the command remains in the code – leaving the door open for potential future abuses. The location and device ID commands also remain present in the latest results despite the developers’ dispute of the fact. This developer should find alternative ways to achieve its objectives than these privacy-risking methods.
Reindeer VPN – Proxy VPN
VPN Details
VPN Developer: Tetrastar technology CO,.
APK file name: com.biganiseed.reindeer
VPN App Installs
100,000 | 4.2 star rating
Intrusive App Permissions
Leaks
No leaks
Dangerous Functions/Behaviors
Virus Test Positives
None
Network Test Results
No anomalies
Free VPN and Fast Connect – OpenVPN for Android
VPN Details
VPN Developer: ATH Software
APK file name: com.apptonghop.vpnfastconnect
VPN App Installs
100,000+ | 4.3 star rating
Intrusive App Permissions
Leaks
No leaks
Dangerous Functions/Behaviors
None
Virus Test Positives
None
Network Test Results
Hotspot VPN – Free Unlimited & Super VPN Proxy
VPN Details
VPN Developer: Aresmob Studio
APK file name: com.aresmob.hotspotvpn
VPN App Installs
100,000+ | 4.2 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Functions/Behaviors
Virus Test Positives
Network Test Results
See full network test
VPN Express – School VPN & Unlimited & Unblock
VPN Details
VPN Developer: FIFA VPN
APK file name: com.atschoolfree.proxy.express.vpn
VPN App Installs
100,000+ | 4.7 star rating
Intrusive App Permissions
Leaks
No leaks
Dangerous Functions/Behaviors
Virus Test Positives
None
Network Test Results
Bot Changer VPN – Free VPN Proxy & Wi-Fi Security
VPN Details
VPN Developer: Bot Changer, Inc.
APK file name: com.botchanger.vpn
VPN App Installs
100,000+ | 4.6 star rating
Intrusive App Permissions
Leaks
None
Dangerous Functions/Behaviors
None
Virus Test Positives
None
Network Test Results
Leafy VPN – Free VPN : Smarter And More Efficient
VPN Details
VPN Developer: Nacl LLC
APK file name: org.amalgam.laboratory
VPN App Installs
100,000+ | 4.5 star rating
Intrusive App Permissions
None
Leaks
Dangerous Functions/Behaviors
Virus Test Positives
None
Network Test Results
Super Fast Hot VPN Free Vpn Proxy Master
VPN Details
VPN Developer: InstaBerry
APK file name: com.editorstudio.super_hot_vpn
VPN App Installs
100,000+ | 4.3 star rating
Intrusive App Permissions
None
Leaks
Dangerous Functions/Behaviors
None
Virus Test Positives
None
Network Test Results
VPN 365 – Free Unlimited VPN Proxy & WiFi VPN
VPN Details
VPN Developer: Better Proxy
APK file name: com.facefaster.android.box
VPN App Installs
100,000+ total installs | 4.5 star rating
Intrusive App Permissions
Leaks
Dangerous Behaviors / Functions
None found
Virus Test Positives
None
Network Test Results
Blocks test traffic
Free VPN by FireVPN
VPN Details
VPN Developer: FireVPN
APK file name: com.firevpn.vpn
VPN App Installs
100,000+ total installs | 4.4 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Behaviors / Functions
None found
Virus Test Positives
None
Network Test Results
No anomalies
Freedom VPN – Free, Secure, Best Service & Speed
VPN Details
VPN Developer: Hallow Smart
APK file name: com.freedomvpn.privatesecurefast
VPN App Installs
100,000+ total installs | 4.1 star rating
Intrusive App Permissions
None
Leaks
Dangerous Behaviors / Functions
None found
Virus Test Positives
None
Network Test Results
Free VPN Master – Fast secure proxy VPN
VPN Details
VPN Developer: Freemaster2018
APK file name: com.free.fast.master.unblock.proxy.vpn
VPN App Installs
100,000+ total installs | 4.8 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Behaviors / Functions
None found
Virus Test Positives
None
Network Test Results
Free Proxy Master
VPN Details
VPN Developer: DevProm
APK file name: com.freemaster.proxy
VPN App Installs
100,000+ total installs | 4.6 star rating
Intrusive App Permissions
Leaks
No leaks
Dangerous Behaviors / Functions
Virus Test Positives
None
Network Test Results
Super Turbo VPN Unblocker
VPN Details
VPN Developer: Unlimited Freedom Apps
APK file name: com.free.super.turbo.vpn.unblocker
VPN App Installs
100,000+ total installs | 4.4 star rating
Intrusive App Permissions
Leaks
Dangerous Behaviors / Functions
Virus Test Positives
None
Network Test Results
Test fails
Free VPN Unlimited Proxy By FishVPN
VPN Details
VPN Developer: Connect Anywhere
APK file name: com.getfishvpn.fishvpn
VPN App Installs
100,000+ total installs | 4.4 star rating
Intrusive App Permissions
Leaks
Dangerous Behaviors / Functions
Virus Test Positives
None
Network Test Results
Blocks test traffic
Gulf Secure VPN
VPN Details
VPN Developer: Gulf Secure VPN
APK file name: com.gulfvpn
VPN App Installs
100,000+ total installs | 4.3 star rating
Intrusive App Permissions
Leaks
No leaks
Dangerous Behaviors / Functions
None found
Virus Test Positives
None
Network Test Results
Blocks test traffic
VPN Provider Response
We received a one-line response from this developer, as follows:
Please review again, we don’t need these permissions anymore.
On testing the latest version of the app, the permissions had been removed.
Our view is that while it’s great news that the permissions are gone, it’s not ideal that the developer provided no information at all as to why they were previously part of the app. This does not indicate that they have a culture of transparency nor a focus on user privacy.
Hoxx VPN
VPN Details
VPN Developer: Hoxx VPN
APK file name: com.hoxxvpn.main
VPN App Installs
100,000+ total installs | 4.5 star rating
Intrusive App Permissions
Leaks
No leaks
Dangerous Behaviors / Functions
Virus Test Positives
None
Network Test Results
VPN Secure Touch Master Unblock Proxy Super Free
VPN Details
VPN Developer: Izzidroids
APK file name: com.Izzidroids.proxy.newvpn2018
VPN App Installs
100,000+ total installs | 4 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Behaviors / Functions
Virus Test Positives
None
Network Test Results
JoyVPN High speed free VPN
VPN Details
VPN Developer: Emanuil Hristov
APK file name: com.joyvpn.android
VPN App Installs
100,000+ | 4.1 star rating
Intrusive App Permissions
Leaks
Test fails
Dangerous Functions/Behaviors
Virus Test Positives
Network Test Results
Test failed
MaxVPN – Free Fast Connect & Unlimited VPN Client
VPN Details
VPN Developer: LVVMobile
APK file name: com.klmobile.maxvpn
VPN App Installs
100,000+ | 4.5 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Functions/Behaviors
Virus Test Positives
None
Network Test Results
No anomalies
VPN Free Super Hot VPN Touch Unblock Proxy
VPN Details
VPN Developer: Instakeet
APK file name: com.logindroids.Hotfree.Vpn
VPN App Installs
100,000+ | 4.0 star rating
Intrusive App Permissions
Leaks
Test failed
Dangerous Functions/Behaviors
Virus Test Positives
None
Network Test Results
Test failed
VPN Melon – Unlimited•Fast•Proxy
VPN Details
VPN Developer: Free Vpn Proxy
APK file name: com.mastervpn.melon
VPN App Installs
100,000+ | 4.6 star rating
Intrusive App Permissions
Leaks
Dangerous Functions/Behaviors
Virus Test Positives
None
Network Test Results
Blocks test traffic
VPN Master – USA
VPN Details
VPN Developer: Free Vpn Proxy
APK file name: com.mastervpn.usa
VPN App Installs
100,000+ | 4.5 star rating
Intrusive App Permissions
Leaks
No leaks
Dangerous Functions/Behaviors
None
Virus Test Positives
None
Network Test Results
Blocks test traffic
5G VPN
VPN Details
VPN Developer: mscmdh2
APK file name: com.mdh.vpn5g
VPN App Installs
100,000+ | 4.6 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Functions/Behaviors
Virus Test Positives
None
Network Test Results
VPN Free Super Speed Unblock Proxy Master
VPN Details
VPN Developer: ns studio
APK file name: com.nsstudio.vpnfree.superspeed.unblock.proxymaster
VPN App Installs
100,000+ | 4.2 star rating
Intrusive App Permissions
Leaks
Test failed
Dangerous Functions/Behaviors
Virus Test Positives
None
Network Test Results
Test failed
OLO VPN – Unlimited Free VPN
VPN Details
VPN Developer: OLO VPN PVT LTD
APK file name: com.olvovpn.app
VPN App Installs
100,000+ | 4.5 star rating
Intrusive App Permissions
Leaks
No leaks
Dangerous Functions/Behaviors
Virus Test Positives
None
Network Test Results
USA VPN – Free VPN Proxy & Wi-Fi Security
VPN Details
VPN Developer: World Vpn
APK file name: com.ow.free.usavpn
VPN App Installs
100,000+ | 4.6 star rating
Intrusive App Permissions
Leaks
Dangerous Functions/Behaviors
Virus Test Positives
None
Network Test Results
Blocks test traffic
VPN Unlimited, Unblock Websites – IP Changer
VPN Details
VPN Developer: Genius Recorder
APK file name: com.proxyfree.ultimate.vpn
VPN App Installs
100,000+ | 4.3 star rating
Intrusive App Permissions
Leaks
Dangerous Functions/Behaviors
Virus Test Positives
None
Network Test Results
Robo VPN – Free VPN PROXY
VPN Details
VPN Developer: Rosislav Oresharov
APK file name: com.robovpn.android
VPN App Installs
100,000+ total installs | 4 star rating
Intrusive App Permissions
Leaks
Tests failed
Dangerous Behaviors / Functions
Virus Test Positives
None
Network Test Results
Tests failed
FastVPN – Free Secured Unlimited Fast VPN Proxy
VPN Details
VPN Developer: SuperApp Inc.
APK file name: com.superapp.fastvpn
VPN App Installs
100,000+ total installs | 4.3 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Behaviors / Functions
None found
Virus Test Positives
None
Network Test Results
Blocks test traffic
UAE FastVPN – Free Unlimited Secured Unblocked VPN
VPN Details
VPN Developer: SuperApp Inc.
APK file name: com.superapp.uaefastvpn
VPN App Installs
100,000+ total installs | 4.2 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Behaviors / Functions
None found
Virus Test Positives
None
Network Test Results
Blocks test traffic
MyMobileSecure Unlimited VPN
VPN Details
VPN Developer: VoiceFive, Inc.
APK file name: com.voicefive.mms
VPN App Installs
100,000+ total installs | 4 star rating
Intrusive App Permissions
Leaks
Dangerous Behaviors / Functions
None found
Virus Test Positives
None
Network Test Results
VPN Master & Free Unblock Proxy 2018
VPN Details
VPN Developer: Abso Green Apps
APK file name: com.vpn.masterfree.unblockproxy.free2018
VPN App Installs
100,000+ total installs | 4.3 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Behaviors / Functions
Virus Test Positives
None
Network Test Results
VPN Tube – Free VPN
VPN Details
VPN Developer: ITehno Viktor Vorobei SP
APK file name: com.vpn_tube.vpntube
VPN App Installs
100,000+ total installs | 4.5 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Behaviors / Functions
Virus Test Positives
None
Network Test Results
VPN Provider Response
The developers of VPN Tube responded as follows:
“As a developer of this app, I can say that we don’t collect any information like user’s location or any IDs, but it may be collected by analytics services (Firebase) which we use in our app.
“So, I’m 100% sure that since Firebase is being included in our app as library dependency – only it may contain the code like you pointed above.”
Our view is that this response perfectly illustrates the approach to free app development that inadvertently puts user privacy at risk. A developer of such a sensitive category of app should have a clear understanding of every line of code in their app, including third-party libraries.
Webzilla Unlimited Free VPN
VPN Details
VPN Developer: Webzilla Apps Inc
APK file name: com.webzilla.vpn
VPN App Installs
100,000+ total installs | 4.4 star rating
Intrusive App Permissions
Leaks
No leaks
Dangerous Behaviors / Functions
Virus Test Positives
None
Network Test Results
Surf VPN – Best Free Unlimited Proxy
VPN Details
VPN Developer: XSoft inc
APK file name: com.xfx.surfvpn
VPN App Installs
100,000+ total installs | 4.7 star rating
Intrusive App Permissions
Leaks
No leaks
Dangerous Behaviors / Functions
Virus Test Positives
None
Network Test Results
No anomalies
VPN Provider Response
Since we downloaded their apk file, the developer updated their app to remove the libraries requiring sensitive permissions and shared the update log with us.
We have rescanned to verify and all have been removed.
Our view is that the devs approach to permissions is positive and to be applauded. If anyone is using an older version of the app (before 1.6.1) should immediately update to the latest version. In terms of the risky functions, while it’s likely true that the location function is not being explicitly used, the door is open for future updates to change that. It’s a concern – although sadly very common in free apps – that the devs don’t know exactly what’s going on in the libraries they use and ideally they would extend the approach they have taken to sensitive permissions to these risky functions also.
Xiaoming VPN
VPN Details
VPN Developer: Xiaoming Addison
APK file name: com.xiaoming.vpn
VPN App Installs
100,000+ total installs | 4.8 star rating
Intrusive App Permissions
Leaks
Dangerous Behaviors / Functions
None found
Virus Test Positives
Network Test Results
Test fails
VPN Provider Response
The developer response is summarized as follows:
They blamed the presence of the sensitive permissions on “developer carelessness”, for which they apologized and promised to rectify by removing the “useless” permissions. They followed through and removed them within six hours, which we have been able to confirm.
Our view is conflicted. We are impressed by the developers responsiveness to the issue and how quickly it was resolved. However, it’s troubling that such sensitive permissions can be included because of “habitual” dev practices and that app testing did not pick this up. Unfortunately, analysis of the latest version of the app shows that there are still numerous positive matches for malware and so this app is still considered high risk.
FastVPN – Free•unblock•proxy
VPN Details
VPN Developer: visual communication
APK file name: com.fast.vpnfree
VPN App Installs
100,000+ total installs | 4.3 star rating
Intrusive App Permissions
Leaks
No leaks
Dangerous Behaviors / Functions
None found
Virus Test Positives
None
Network Test Results
Star VPN – Free VPN Proxy App
VPN Details
VPN Developer: Star VPN
APK file name: com.peach.vpn
VPN App Installs
100,000+ | 4.2 star rating
Intrusive App Permissions
Leaks
No leaks
Dangerous Functions
None
Virus Test Positives
None
Network Test Results
Super Power VPN proxy Master-fast security privacy
VPN Details
VPN Developer: HOTVPN Team
APK file name: free.unblock.pro.powervpn
VPN App Installs
100,000+ | 4.5 star rating
Intrusive App Permissions
Leaks
No leaks
Dangerous Functions/Behaviors
None
Virus Test Positives
Network Test Results
India VPN – Unlimited Free & Fast Security Proxy
VPN Details
VPN Developer: World Vpn
APK file name: free.unblock.proxy.vpnindia.indiavpn
VPN App Installs
100,000+ | 4.5 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Functions/Behaviors
None
Virus Test Positives
None
Network Test Results
Blocks test traffic
Combo VPN
VPN Details
VPN Developer: iStark
APK file name: istark.combovpn.combovpn
VPN App Installs
100,000+ | 4.1 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Functions/Behaviors
Virus Test Positives
None
Network Test Results
VPN Provider Response
The Combo VPN developers provided a very brief response, which as it was identical to not only their other app Stark VPN but also to the response for Anonytun, revealing them to be the same people despite a different developer name, details as follows:
Our view is that this shows – at best – a disturbing lack of knowledge of how their own app works that should give users pause for thought before entrusting them with their internet activity and all the personal data that entails.
GetBehind.me | Ultimate VPN Provider
VPN Details
VPN Developer: Siteflex LLC
APK file name: me.getbehind.android
VPN App Installs
100,000+ | 4.0 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Functions/Behaviors
None
Virus Test Positives
None
Network Test Results
Cloud VPN – Proxy Server – Unlimited
VPN Details
VPN Developer: CM Team
APK file name: mobi.cmteam.cloudvpn
VPN App Installs
100,000+ | 4.4 star rating
Intrusive App Permissions
Leaks
No leaks
Dangerous Functions/Behaviors
Virus Test Positives
None
Network Test Results
Totally Free VPN Unlimited, Secure & Free!
VPN Details
VPN Developer: Rejinderi
APK file name: net.rejinderi.totallyfreevpn
VPN App Installs
100,000+ | 4.1 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Functions/Behaviors
Virus Test Positives
None
Network Test Results
No anomalies
Free VPN – Unblock & Fast Hotspot Security Proxy
VPN Details
VPN Developer: Super VPN & Free Proxy
APK file name: com.unblock.proxy.freevpn
VPN App Installs
100,000+ | 4.1 star rating
Intrusive App Permissions
Leaks
Dangerous Functions/Behaviors
None
Virus Test Positives
None
Network Test Results
VPN Gate List (Best Free VPN)
VPN Details
VPN Developer: Rejinderi
APK file name: net.rejinderi.vpngatelist
VPN App Installs
100,000+ | 4.0 star rating
Intrusive App Permissions
Leaks
No leaks
Dangerous Functions/Behaviors
Virus Test Positives
None
Network Test Results
VPN Master
VPN Details
VPN Developer: VPN Master
APK file name: vpn.vpnmaster
VPN App Installs
100,000+ | 4.0 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Functions/Behaviors
None
Virus Test Positives
None
Network Test Results
21VPN – Unlimited & Free VPN
VPN Details
VPN Developer: alloc64, s.r.o
APK file name: net.twentyonevpn.free.vpn.proxy.client
VPN App Installs
100,000+ | 4.4 star rating
Intrusive App Permissions
Leaks
No leaks
Dangerous Functions/Behaviors
Virus Test Positives
None
Network Test Results
VPN Provider Response
The developers of 21VPN sent a highly detailed and thoughtful response to our enquiries, summary as follows:
WRITE_EXTERNAL_STORAGE is used for storing logs by the IKEv2 daemon (IKEv2 is a VPN protocol) and for caching ads. The dev states they do not access private files on the device.
Our view is that while this is another example of advertising solutions causing potential privacy issues. While the risky functions may currently lack the relevant permissions to intrude on privacy, there’s no guarantee that should the app change hands in future that the developers continue to act in good faith. Consumers should also be aware of the ad caching issue and decide for themselves whether they are comfortable with the use of their device in such a way. Nevertheless, it’s a positive move that the devs are working on reducing the use of ad networks.
Supper VPN Proxy
VPN Details
VPN Developer: Abc Studio
APK file name: com.abcstudio.proxy.vpn
VPN App Installs
50,000+ | 4.2 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Functions/Behaviors
Virus Test Positives
None
Network Test Results
VPN Proxy Pro 2017
VPN Details
VPN Developer: Apps Island
APK file name: com.appsisland.pro.vpn.proxy
VPN App Installs
50,000+ | 4.2 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Functions/Behaviors
Virus Test Positives
None
Network Test Results
Blocks test traffic
SuperVPN 2018 – Secure, Unlimited VPN Master Proxy
VPN Details
VPN Developer: Aresmob Studio
APK file name: com.aresmob.supervpn2018
VPN App Installs
50,000+ | 4.3 star rating
Intrusive App Permissions
Leaks
No leaks
Dangerous Functions/Behaviors
None
Virus Test Positives
Network Test Results
VPN Sky – Super Free VPN Master Proxy
VPN Details
VPN Developer: Aresmob Studio
APK file name: com.aresmob.vpnsky
VPN App Installs
50,000+ | 4.3 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Functions/Behaviors
None
Virus Test Positives
Network Test Results
Easy VPN – Free VPN Proxy & Super Fast VPN Hotspot
VPN Details
VPN Developer: ATH Software
APK file name: com.ath.easyvpn
VPN App Installs
50,000+ | 4.4 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Functions/Behaviors
Virus Test Positives
None
Network Test Results
Smart VPN – Unlimited Free VPN & Fast Security VPN
VPN Details
VPN Developer: Brainlab
APK file name: com.brainlab.smartvpn
VPN App Installs
50,000+ | 4.5 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Functions/Behaviors
Virus Test Positives
None
Network Test Results
Super VPN 2018 Unlimited Master Unblock Proxy
VPN Details
VPN Developer: MaazAppsMentor
APK file name: com.droidmentor.free_vpn_super_proxy_master_unlimited.unblock_site
VPN App Installs
50,000+ | 4.1 star rating
Intrusive App Permissions
Leaks
Test failed
Dangerous Functions/Behaviors
Virus Test Positives
None
Network Test Results
Test failed
Free VPN
VPN Details
VPN Developer: Emoji Studio – Free Music Player & QR Code & VPN
APK file name: com.emoji.freevpn
VPN App Installs
50,000+ | 4.4 star rating
None
Leaks
Test failed
Dangerous Functions/Behaviors
Virus Test Positives
None
Network Test Results
Test failed
unlimited free easy vpn proxy
VPN Details
VPN Developer: Apps Trend Setter
APK file name: com.free.unlimitedvpn.freeproxy.bestvpn.master.app
VPN App Installs
50,000+ | 4.2 star rating
Intrusive App Permissions
None
Leaks
Test failed
Dangerous Functions/Behaviors
Virus Test Positives
None
Network Test Results
Test failed
Best Free VPN – Squid VPN
VPN Details
VPN Developer: Professional VPN
APK file name: com.get.squidvpn
VPN App Installs
50,000+ total installs | 4.3 star rating
Intrusive App Permissions
Leaks
No leaks
Dangerous Behaviors / Functions
Virus Test Positives
None
Network Test Results
Best Free VPN Proxy – FalcoVPN
VPN Details
VPN Developer: Infoweise Pty Ltd
APK file name: com.infoweise.falcovpn
VPN App Installs
50,000+ total installs | 4.5 star rating
Intrusive App Permissions
Leaks
No leaks
Dangerous Behaviors / Functions
Virus Test Positives
None
Network Test Results
Ghost Free VPN Super VPN Safe Connect
VPN Details
VPN Developer: BerryDevelopers
APK file name: com.loyeltech.free_super_vpn_ghost_master
VPN App Installs
50,000+ total installs | 4.4 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Behaviors / Functions
Virus Test Positives
None
Network Test Results
MeteorVPN – FREE VPN
VPN Details
VPN Developer: Rosislav Oresharov
APK file name: com.meteorvpn.android
VPN App Installs
50,000+ total installs | 4 star rating
Intrusive App Permissions
Leaks
Tests failed
Dangerous Behaviors / Functions
Virus Test Positives
None
Network Test Results
Tests failed
Flash VPN – Best Free VPN Secure for Android
VPN Details
VPN Developer: Joymore Apps
APK file name: com.milk.ss
VPN App Installs
50,000+ total installs | 4.6 star rating
Intrusive App Permissions
Leaks
Dangerous Behaviors / Functions
None found
Virus Test Positives
Network Test Results
unblock websites proxy Free Unlimited VPN
VPN Details
VPN Developer: khasologix
APK file name: com.phonevpnfree.unblocksites.proxybrowser
VPN App Installs
50,000+ total installs | 4 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Behaviors / Functions
Virus Test Positives
None
Network Test Results
SetupVPN
VPN Details
VPN Developer: SetupVPN
APK file name: com.setupvpn.main
VPN App Installs
50,000+ total installs | 4.6 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Behaviors / Functions
Virus Test Positives
None
Network Test Results
Panda Free VPN
VPN Details
VPN Developer: Plex Inc.
APK file name: com.shoplex.freevpn
VPN App Installs
50,000+ total installs | 3.9 star rating
Intrusive App Permissions
Leaks
Test fails – fake app
Dangerous Behaviors / Functions
Virus Test Positives
None
Network Test Results
Test fails – fake app
Super VPN Hotspot – VPN Private (Totally Free)
VPN Details
VPN Developer: AppsHub Droid
APK file name: com.softappsdev.vpn.unlimited
VPN App Installs
50,000+ total installs | 4.2 star rating
Intrusive App Permissions
None
Leaks
No leaks
Dangerous Behaviors / Functions
None found
Virus Test Positives
None
Network Test Results
Methodology
We identified the top 150 free VPN apps on the Google Play store and downloaded the binaries for analysis. The binaries were scanned using the VirusTotal tool, the resulting reports for each app identified the following: matches against major databases for known malware and viruses; app permissions; and dangerous functions and behavior.
Each app was also installed on an Android smartphone and a VPN connection created. This network connection was tested using the Netalyzr tool and results captured for analysis.
The same connection was used to visit browserleaks.com and perform the IP tests. These were compared against control tests conducted without a live VPN connection.
All tests were carried out and data collected between Nov – Dec 2018 and were correct at the time of publication.
The authors of all our investigations abide by the journalists’ code of conduct.