Is Greenhub Free VPN - Secure and Unblock VPN safe?
Greenhub Free VPN can install a PAC proxy that routes ad and tracker domains through Greenhub-controlled proxies.
A remote options-page config can make the extension set a PAC proxy for ad and tracker domains, sending those requests through aproxy.mgreen.cf:58124 for non-US users. When the options page opens, the extension also sends telemetry to p.ghhub.tk/p.gif, including its user ID, version, stored public IP, install time, language, and platform.
Who publishes itDataMM Group - no other listings under this identity
DataMM Group - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Options page beacons your public IP and a persistent ID to p.ghhub.tk
Opening the extension's options page immediately sends your public IP address and a persistent per-install ID to p.ghhub.tk via an off-screen image beacon, with no consent prompt shown.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open the extension's options page at options.discordmate.top.
This happens automatically once right after install, and again any time you revisit the page.
A content script sends your public IP address and a persistent per-install ID to p.ghhub.tk before you interact with the page.
The request is an off-screen 1x1 image load, so nothing appears in the page's visible content.
1x1 transparent GIF (image beacon, no meaningful response body). The ip, ver, plat, event, lang, install_time and time values shown were the values observed during dynamic analysis; the uid value shown is an illustrative uuid v4 in the extension's own ID format, since the specific ID assigned to that test install was not retained.
- Your public IP address187.40.254.11
Identifies your device's approximate location and network, and can be used to correlate this beacon with other activity from the same IP.
- Persistent installation ID3f9a2c7e-51b4-4d68-9c2a-7e6f0b1d4a88 (illustrative)
A random ID generated once and stored locally, then attached to every beacon so the vendor can recognize this specific install indefinitely.
- Extension version0.11.1
Tells the vendor which build sent the beacon.
- Event nameext-options-open
Labels this beacon as an options-page-open event, distinct from the extension's other telemetry events.
- Platform tagGH
A fixed code identifying which build/listing generated the beacon.
- Install timestamp1757203200
Records when the extension was first installed on this device.
- Beacon timestamp1757337600
Marks exactly when this page view happened.
- Browser languageen-US
Adds a locale detail that narrows down who you are when combined with the IP and install ID.
The options page firing the beacon, and the beacon builder it calls
content-script.js: first statement executed on page load
js/content-script.jsimport "core-js/modules/es.array.includes";import { tongjiEvent } from "./telemetry";tongjiEvent("ext-options-open", {});Shared telemetry helper that builds and fires the beacon
js/content-script.jsimport { getGreenhubExt, getUserIP, storageGet } from "./storage";const TELEMETRY_ENDPOINT = "https://p.ghhub.tk/p.gif";async function buildBeaconUrl(eventName, params) { params.event = eventName; const ext = await getGreenhubExt(); // { uid, version } const ip = await getUserIP(); // chrome.storage.local.userIP const installTimeRow = await storageGet("installTime"); const lang = await chrome.i18n.getUILanguage(); params.uid = ext.uid; params.ver = ext.version; params.ip = ip; params.plat = "GH"; params.install_time = installTimeRow?.installTime ?? 0; params.time = unixTimestamp(); params.lang = lang; return `${TELEMETRY_ENDPOINT}?${new URLSearchParams(params)}`;}async function sendBeacon(eventName, params = {}) { if (!eventName) return; const url = await buildBeaconUrl(eventName, params); if (url) { const beaconImg = new Image(); beaconImg.style.display = "none"; beaconImg.src = url; // assigning src fires the GET document.body.appendChild(beaconImg); }}// exported as tongjiEvent()async function tongjiEvent(eventName, params = {}) { await sendBeacon(eventName, params);}- p.ghhub.tk
Receives the telemetry beacon on every options-page open: public IP, persistent install ID, version, event name, timestamps, and browser language.
- ipinfo.io
Queried once at install time to resolve the device's public IP address, cached locally afterward.
- ip-api.com
Queried in parallel with ipinfo.io as a fallback IP-lookup provider; whichever responds first is used.
What it can do
Permissions this extension asks for, as declared in version 0.11.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
<all_urls>
Store data in your browser
storage
Route all of your browsing through a server of its choosing
proxy
Schedule its own background tasks
alarms
Where it sends data
Destinations our analysis observed Greenhub Free VPN - Secure and Unblock VPN contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- aproxy.mgreen.cf
Greenhub Free VPN - Secure and Unblock VPN sends data to aproxy.mgreen.cf. No other extension we have analysed sends data here.
- p.ghhub.tk
Greenhub Free VPN - Secure and Unblock VPN sends data to p.ghhub.tk. No other extension we have analysed sends data here.