VPNMentor's blog publishes VPN reviews and reports on data breaches and leaks found by its security researchers.
HN links it for leak reports like the BioStar 2 breach, while commenters note it is a VPN review site acquired by Kape for its affiliate revenue.
People should take this list with a serious health warning. Firstly, a lot of this is just 'internet sleuth'ing and innuendo. Plenty of companies want to operate multiple services to be able to use different marketing and differentiation strategies. Secondly, the fact that the site is funded by affiliate links to a coupole of the big VPN services should really ring alarm bells. I trust we all learned from the Mattress review debacles? [1]
Thirdly, the companies who are funding this site through affiliate links, despite not being investigated in this article are arguably more worth of some serious suspicion. For example: NordVPN, one of their "Top VPN providers" is run by the same guy who runs a Lithuanian data harvesting company[2], but don't worry, lots of websites who make money from affiliate links to NordVPN (Sign up Now! 75% off when you use the code "SCAM" at checkout!)
Now, maybe I'm being cynical - but I suspect if NordVPN weren't lining the pockets of all these referral websites their reviews of NordVPN would involve a lot more of the faux concern they show about other VPN companies in this hit piece, rather than the credulous write-ups about how it's totally not a problem that this shifty Panamanian company has suspicious links to data harvesters.
[1]:https://www.fastcompany.com/3065928/sleepopolis-casper-bloggers-lawsuits-underside-of-the-mattress-wars
[2]:https://www.vpnmentor.com/blog/is-nordvpn-operated-by-tesonet/
Upstream post:
https://www.vpnmentor.com/blog/report-biostar2-leak/
Quote :
Our team was able to access over 27.8 million records, a total of 23 gigabytes of data, which included the following information:
- Access to client admin panels, dashboards, back end controls, and permissions
- Fingerprint data
- Facial recognition information and images of users
- Unencrypted usernames, passwords, and user IDs
- Records of entry and exit to secure areas
- Employee records including start dates
- Employee security levels and clearances
- Personal details, including employee home address and emails
- Businesses’ employee structures and hierarchies
- Mobile device and OS information
One of the more surprising aspects of this leak was how unsecured the account passwords we accessed were. Plenty of accounts had ridiculously simple passwords, like “Password” and “abcd1234”. It’s difficult to imagine that people still don’t realize how easy this makes it for a hacker to access their account.
Likely explanation for this type of discovery would be either internet wide scans of known services or happening across these servers while reverse-engineering an app / protocol related to the specific service. The former seems to be the case here, as the authors refer to some of their "web-mapping" efforts in the last paragraph and have previously published similar findings [1, 2] they discovered through the same process. You can get starting points for probing into this as a service from places like [3] if you don't want to perform the scan on your own infrastructure - although the tools for this became insanely accessible over the last few years (at least for IPv4 coverage).
[1] https://www.vpnmentor.com/blog/report-millions-homes-exposed/
[2] https://www.vpnmentor.com/blog/report-theta360-leak/
[3] https://www.shodan.io/
Thanks, the last fetched page on archive.org is from 2025-01-26 [1], removed after this date and before 2025-02-13. 155,477 users at the moment, 1 star reviews were mostly about not working. It's interesting that the developers didn't care to remove the button directing to the ff add-on page at least several months after the removal. Maybe was some kind of PR compromise, they probably thought that listing it with linking to a broken page was better than not listing at all.
A review page [2] mentions that this add-on is a peer-to-peer vpn, not having its own dedicated servers that already makes it suspicious.
[1] https://web.archive.org/web/20250126133131/https://addons.mozilla.org/en-US/firefox/addon/urban-vpn/
[2] https://www.vpnmentor.com/reviews/urban-vpn/
1. The original write-up can be found here: https://www.vpnmentor.com/blog/report-facebook-scam/
2. Facebook was not breached in the sense that is normally meant by that term.
3. You may assume that the "bitcoin scam" is untraceable and the scammers will get away because it used cryptocurrency. Not the case. They were spamming links to "bitcoin trading" platforms which accept deposits using credit cards and which are a modern reincarnation of "forex trading" scam platforms. The industry is mostly based out of Israel and uses the normal banking system and even accepts credit cards, as I mentioned. The only reason the criminals won't get caught is that no government will prioritize this.
Related
Searches for VPNs spike in Texas after Pornhub pulls out of the state (3 points, 10 months ago, no comments) https://news.ycombinator.com/item?id=39748715
Searches for VPN Soar in Utah Amidst Pornhub Blockage (217 points, 2 years ago, 289 comments) https://news.ycombinator.com/item?id=35807408
The spike was detected/reported by one site only (https://www.vpnmentor.com/news/vpn-demand-surge-florida/). Nice SEO for them.
Note vpnMentor is pretty obscure, the NYT/Wirecutter didn't include it in a recent roundup [The Best VPN Service (2024)](https://www.nytimes.com/wirecutter/reviews/best-vpn-service/)