Is Врубель - VPN для YouTube от 1 руб в день safe?
This extension provides a VPN service for watching YouTube with faster video loading.
It is described as a one-button VPN for YouTube that helps videos load quickly and in good quality. The store description also says it offers unlimited traffic, no ads, and pricing from 1 ruble per day.
Who publishes itЮбуст - no other listings under this identity, 4 shared hostnames
Юбуст - no other listings under this identity, 4 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 4 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Persistent client ID sent to Google Analytics on every install and proxy action
This VPN extension sends a persistent tracking ID to Google Analytics on every install, update, or proxy connection, using a hardcoded GA credential.
Every event carries the same client ID, tying actions together without a user account.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You install, update, or use the VPN's proxy features.
This includes actions like connecting the proxy, or the extension detecting a conflict with another extension.
The extension sends a Google Analytics event tagged with a persistent ID stored in your browser.
Every event uses the same client ID, so Google Analytics can link these actions together as one profile.
HTTP 204 (accepted). We observed 8 such POSTs during a single session, all sharing the same client_id, with events for install, update, user_created, and manual_start actions.
{ "client_id": "25650b9d-4b8b-4186-bbcb-6bff576781e3", "events": [ { "name": "user_action", "params": { "action": "install", "category": "extension", "session_id": "1756512094821", "engagement_time_msec": 100 } } ]}- Client ID25650b9d-4b8b-4186-bbcb-6bff576781e3
A random ID generated once and stored in your browser, then reused on every event so they can all be tied together.
- Session ID1756512094821
A timestamp-based ID that groups events from the same browsing session.
- Event name and categoryuser_action / proxy / manual_start
What you did: installing, updating, connecting the proxy, or hitting a conflict with an ad blocker or another proxy extension.
The sendEvent() function and its hardcoded GA4 API credential
class AnalyticsService { sendEvent(event) { return (async () => { try { const [clientId, sessionId] = await Promise.all([ this.getOrCreateClientId(), this.getOrCreateSessionId() ]); const payload = { client_id: clientId, events: [{ name: event.name, params: { ...event.params, session_id: sessionId, engagement_time_msec: 100 } }] }; const res = await fetch( "https://www.google-analytics.com/mp/collect?measurement_id=G-XCPV2XK66M&api_secret=<redacted>", { method: "POST", body: JSON.stringify(payload) } ); if (!res.ok) console.error("Failed to send GA event:", await res.text()); } catch (e) { console.error("Error sending GA event:", e); } })(); } trackUserAction(action, category, label) { return this.sendEvent({ name: "user_action", params: { action, category, label } }); }}- www.google-analytics.com
Google's GA4 Measurement Protocol collector. Receives the client ID, session ID, and event names for every tracked action under the developer's GA4 property (G-XCPV2XK66M).