Is SmartProxy safe?
SmartProxy loads an AvaProxy favicon from avaproxy.com when its settings page opens.
The default About tab in the options page embeds an affiliate ad whose image is loaded from www.avaproxy.com. Opening that settings page makes Chrome request the remote favicon, exposing the user's IP address to that domain; the reviewed report did not identify high-risk data collection.
Who publishes itSalar K - no other listings under this identity
Salar K - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Opening Settings Loads a Third-Party Favicon That Reveals Your IP
Opening SmartProxy's settings page loads an affiliate ad for AvaProxy, including a favicon fetched from avaproxy.com.
Two requests fired within ~200ms of load, before any click, exposing your IP to avaproxy.com with no proxy setup needed.
You open the SmartProxy extension's settings page.
The About tab immediately requests an affiliate favicon image from avaproxy.com, before you click anything on the page.
The request fires from the settings page itself, not a background script, and needs no proxy or account configured.
| Field | Value | Why it matters | |
|---|---|---|---|
Your IP address | 203.0.113.42 (illustrative) | Any HTTP connection reveals the IP address making the request, no separate tracking parameter is needed. | |
Browser and OS details | Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0 | Standard headers sent with the request, such as User-Agent, let avaproxy.com see your browser and operating system. |
- avaproxy.com
Affiliate VPN/proxy vendor promoted in SmartProxy's settings page. Receives the favicon image request and, incidentally, the visitor's IP address via the HTTP connection itself.
Downloads the current SmartProxy extension package from the Chrome Web Store and confirms the settings-page markup embeds a favicon request to avaproxy.com.
#!/usr/bin/env bash
# Confirms SmartProxy's ui/settings.html embeds a third-party favicon
# request to avaproxy.com that fires as soon as the settings page loads.
set -euo pipefail
CRX_ID="jogcnplbkgkfdakgdenhlpcfhjioidoj"
WORKDIR=$(mktemp -d)
cd "$WORKDIR"
echo "Downloading extension package..."
curl -sL -o extension.crx \
"https://clients2.google.com/service/update2/crx?response=redirect&prodversion=120&acceptformat=crx3&x=id%3D${CRX_ID}%26uc"
echo "Unpacking..."
unzip -oq extension.crx -d extracted
echo "Searching ui/settings.html for the avaproxy.com favicon reference..."
grep -n "avaproxy.com" extracted/ui/settings.html || echo "Not found in this build."
rm -rf "$WORKDIR"
- 1Run bash verify-avaproxy-favicon.sh. It downloads SmartProxy's current CRX from the Web Store, unpacks it, greps ui/settings.html for the avaproxy.com favicon reference, and prints the matching line.
Where it sends data
Destinations our analysis observed SmartProxy contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.avaproxy.com
SmartProxy sends data to www.avaproxy.com. No other extension we have analysed sends data here.