Is FastStunnel VPN safe?

Low risk

FastStunnel VPN can fetch an HTTP bootstrap file that selects the API server receiving login credentials and session tokens.

When its built-in servers are unavailable, FastStunnel VPN reads an unauthenticated README.md from 138.68.234.207 and trusts the decoded API list it returns. The selected server receives registration and login email addresses with MD5-hashed passwords through /appServlet, then receives the stored session cookie and last user over /appEndpoint.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

FastSecurityTunnelv1.612Chrome Web Store
15Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Where it sends data

Destinations our analysis observed FastStunnel contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • 138.68.234.207

    FastStunnel sends data to 138.68.234.207. No other extension we have analysed sends data here.

  • ext-1.iossync.com

    FastStunnel sends data to ext-1.iossync.com. No other extension we have analysed sends data here.

  • ext-2.iossync.com

    FastStunnel sends data to ext-2.iossync.com. No other extension we have analysed sends data here.

Updated 30 September 2026bblcccknbdbplgmdjnnikffefhdlobhp