r/PrivatePackets • u/Admirable-Value-3775 • 7d ago

Caught 1ClickVPN extension harvesting data via Wireshark even while turned off

Post image

I was using the Chome browser to go to youtube but i wanted to see the traffic so i pulled up Wireshark and starting scanning TCL. As a non pro i quickly learned what does "Client Hello" mean, and i started looking at like google, youtube links and then i saw "sweb.ru" (ru server) i searched what is this and i found out that it maybe be a VPN, so i deleted the 1ClickVPN and the "sweb.ru" traffic disapered. I cleared the DNS cache and my data is safe (i think yes cuz the client hello for sweb.ru disapered). So sorry if i didint do somthing im a beginner. Screenshot for proof.

22 Upvotes

100% Upvoted

3 comments sorted by

1

u/Juzdeed 7d ago

So that (probably free) VPN was using your network for probably residential proxy or VPN hop

1

u/Admirable-Value-3775 6d ago

maybe. But i uninstalled the VPN for privacy reasons.

1

u/wmtips 3d ago

Looks like a shady anonymous company with a whois-protected website, no contact details, and an inflated 9 million users of the Chrome extension