Is VPN99 — fast secure VPN safe?

Low risk

VPN99 sends bearer-token API calls to a fallback host supplied by its S3 configuration when the primary API fails.

When VPN99 cannot reach its primary API, its background worker reads a fallback host list from https://s3.amazonaws.com/vpnwholesaler/vpn99.json and accepts a returned API host that responds with JSON. After that rewrite, account API requests such as token refresh or package checks include Authorization: Bearer tokens to the selected fallback host.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

Shopcut LLCv4.2.9Chrome Web Store
21Risk
Who publishes it

Shopcut LLC - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Shopcut LLC
Declared legal entity
Shopcut LLC
Registered address
36-10 High St, Fair Lawn, NJ 07410-5218, US
Registered contact
Isaac Cohen

Same operator - 1 listing

Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

What it can do

Permissions this extension asks for, as declared in version 4.2.9. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • See the address and title of every tab you have open

    tabs

  • Route all of your browsing through a server of its choosing

    proxy

  • Store data in your browser

    storage

  • Change your browser's privacy and security settings

    privacy

  • Watch every request your browser makes

    webRequest

  • Show you desktop notifications

    notifications

  • Schedule its own background tasks

    alarms

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Run its own code inside the pages you visit

    scripting

webRequestAuthProvider
Updated 30 September 2026jhilaocgbpkchpomekiejhldihlmhikd