On the surface, it may seem that the VPN market is teeming with various companies competing for a piece of the growing consumer VPN pie.
However, when we began to look further into the VPNs and the companies that own them, we noticed something interesting: a lot of these products are owned by the same company. With our interests piqued, we decided to dig deeper to see just how many VPN products are owned or operated by which companies.
The number may surprise you:
Our research shows that at least 104 VPN products are owned or operated by only 24 companies.
This includes both cross-platform and mobile-only VPN products. It also includes direct subsidiaries or products/brands, as well as white label services. This represents a much bigger number than was previously reported in other research.
For our analysis, we only included parent companies that own or operate more than one VPN product.
Why is this important?
When it comes to the true ownership of various VPN products and brands, it’s important to know which company owns or operates the users’ data. There are two big possible issues to consider.
1. Data privacy
If the parent companies are actually located in Fourteen Eyes countries, which are typically high-surveillance countries, users’ data could be wide open to those governments. If they are in Russia, China, and other authoritarian or repressive governments, they are forced to provide their data to the governments on a default basis (as we discussed before in our Chinese surveillance analysis). The parent company may also be willing to sell user data.
“If U.S. intelligence experts believe Beijing and Moscow are leveraging Chinese and Russian-made technology to surveil Americans, surely DHS should also be concerned about Americans sending their web browsing data directly to China and Russia.”
2. Data security
If the owning company is untrustworthy, it could bring up many problems. Parent companies that have been shown to have major vulnerabilities, or even include suspicious add-ons and possible phishing emails with malware, could lead to user data being stolen or even their computers being hacked.
The most important points our research showed:
- We show that almost a third of the popular mobile-only VPNs are actually Chinese (run by Chinese nationals or actually located in China). This means user data is likely open to Chinese authorities, confirming US Senators’ fears of American data falling into Chinese or Russian hands.
- Kape Technologies is known for changing its name from Crossrider in 2018. That’s because, under the latter title, they’ve been injecting users’ devices with adware and malware while collecting personal data. Now the company owns ExpressVPN, CyberGhost VPN, Private Internet Access, and ZenMate.
- j2 Global (via StackPath) owns or operates at least 13 VPN products. However, it officially claims to own just 6: IPVanish, StrongVPN, Encrypt.me (formerly Cloak), SaferVPN, Perimeter 81, and Buffered VPN (which merged with Encrypt.me). We show that it provides white label services for VPNHub and NameCheap VPN and operates 5 other VPN products.
- Similarly, AnchorFree officially claims only Hotspot Shield, TouchVPN, and JustVPN products. However, it hides the fact that it owns Betternet products as well, for a total of 10 owned VPN products.
- Gaditek, the Karachi-based tech company, officially claims to own just 3 VPN products (PureVPN, Ivacy VPN, and the newer Unblock VPN & Proxy). However, we’ve discovered two more VPN products. We also show that this company runs the VPN review sites vpnranks.com, bestvpnservice.com, bestvpn.co, and 2 others.
- Nord Security, known for NordVPN and NordLayer (ex-NordVPN Teams) also owns Atlas VPN.
- The popular mobile VPN developer Innovative Technologies has 10 VPN products under its belt. We show that 2 of those VPN products are by its other company, Lemon Clove, and another 2 by Autumn Breeze 2018, which it also owns.
- American company Actmobile Networks, with 3 VPN mobile apps, also runs or operates Free VPN LLC, for a total of 6 VPN products.
You can view the full summary of our findings in our detailed infographic. Below, you can see how many VPN products are available in the Google Play and Apple App stores.
1. j2 Global (via StackPath) – 13 total VPN offerings
j2 Global (which also owns the tech publication PCMag) recently acquired StackPath’s VPN products. StackPath is listed as “an American content delivery network, cloud service, and web application firewall provider.” In an attempt to broaden its offerings, StackPath purchased Highwinds in 2017, and along with that came IPVanish, StrongVPN, and Encrypt.me (formerly Cloak).
In July 2019, j2 Global announced that it purchased the Israeli-based SaferVPN, and in November 2019 Encrypt.me merged with Buffered VPN. Through its white label section, WLVPN, which StackPath purchased in 2016, it offers white label VPN services for both VPNHub (Pornhub’s VPN) and Namecheap VPN. Reddit users discovered that NameCheap VPN uses the WLVPN service.
On WLVPN’s website, they list the Overplay VPN service as one of their customers as well.
Based on DNS server addresses, Unblock-Us is also connected to WLVPN/Highwinds and owned or operated by StackPath or CEO Lance Crosby.
In fact, through Crosby, we can connect these other VPNs as well:
- netDNA (offers customized VPN services)
- Secured Connectivity
First interesting point raised:
Unblock-us is not listed as being a client of WLVPN or having any affiliation with Highwinds or StackPath.
However, when looking at the instructions for setting up Unblock-us on Windows, we find these DNS server addresses.
They are both connected to the Highwinds organization.
DNS 1: 220.127.116.11
DNS 2: 18.104.22.168
Besides the DNS server clue, a look at their employee’s LinkedIn profiles also reveal some interesting trends:
Peter Gratale’s LinkedIn profile shows that he worked at both Unblock US and Highwinds from 2014 to 2016:
Second interesting point raised:
You may have noticed two different names for the same Unblock-Us service: UnblockUS and Unblock-Us. There are two separate LinkedIn pages for these “companies”: UnblockUS and Unblock-Us, which leads us to a company called NetProtect. However, both of these company pages list the website www.unblock-us.com as their domain, which is the actual website for the Unblock-Us VPN service.
Both unblock-us.com and netprotect.com have the same favicon:
Unblock-Us has the following address listed at the bottom of its website:
NetProtect Ltd, 236 Strovolos Avenue, Strovolos, 2048, Nicosia, Cyprus
When looking at NetProtect’s website, we see the following two addresses listed:
Worldwide: 21 Pine Road, Belleville, St Michael, BB11113, Barbados | EU: NetProtect Ltd, Grigori Afxentiou, 133 Agios Dometios, 2369, Nicosia Cyprus
They show the same company name (NetProtect Ltd.) with slightly different addresses in Cyprus. However, when you go to this URL: https://promo.unblock-us.com/welcome, you’ll see the same two addresses from NetProtect’s website.
And when we took a look at the Barbados address, we discovered that there were, in fact, 96 entities registered at the same address (thanks to the Panama Papers). None of them are NetProtect or Unblock-us.
At this point, it’s safe to say that they’re both the same company.
And to connect it all back to StackPath, just in case we haven’t proven our point yet: There’s a company called Netprotect LLC registered in Florida. Here are the key people in that company:
If that name looks familiar to you, it’s because that’s the same Lance Crosby…
…who owns Highwinds Network Group…
…as well as StackPath, Overplay, Strong Technology (StrongVPN), and many other companies.
2. AnchorFree – 10 total VPN products
AnchorFree has been involved in the VPN industry since introducing its main product, Hotspot Shield, in 2008. In February 2015, AnchorFree acquired JustVPN and TouchVPN. JustVPN has just one VPN product: an Android app called “JustVPN – Free Unlimited VPN & Proxy.”
TouchVPN has three unique apps. Two are for Android (Touch VPN, VPN 360), and three are for iOS: VPN 360, Touch VPN, VeePee VPN Proxy.
In November 2016, Betternet Technologies was acquired by AnchorFree. Betternet creates the following mobile apps:
- VPN Free – Betternet Hotspot VPN & Private Browser
- VPN Proxy by HexaTech
- VPN in Touch (developer listed as just “Betternet”)
- Best VPN Proxy Betternet
- HexaTech Unlimited VPN
- VPN in Touch
- VPN Pro | Lifetime Proxy & Best VPN by Betternet
Eliminating duplicate iOS and Android apps (with different names), we see that AnchorFree has 10 total VPN products, including unique app offerings.
Interesting points raised:
Coming to the conclusion that AnchorFree acquired Betternet was a task in and of itself. You see, there’s no record of that acquisition ever having happened. So how do we know AnchorFree owns Betternet?
A couple of things.
Now, the main question: why did AnchorFree put out a press release for its acquisition of JustVPN and TouchVPN, but not for Betternet? In fact, why is there no direct information at all about this acquisition (company blog posts, press releases, mentions in interviews, articles, etc.), even though this information is readily available?
This is most probably related to all the bad news surrounding Betternet – and research showing that it’s one of the worst VPN providers out there.
3. Gaditek: 7 total VPN products
Gaditek is a Pakistan-based company that owns PureVPN, Ivacy, and Unblock – a newer VPN and proxy product.
The interesting point is that this “New Age” company also has interesting marketing practices. The employees of Gaditek/PureVPN have also been connected to the following VPN review sites:
- bestvpn.co (previously bestvpnprovider.com)
This is a profile from Humayoun Khan, who worked at Gaditek from 2014-2015 and wrote “unbiased VPN reviews” for vpnranks.com, netflixdown.com, and bestvpnprovider.com:
Additionally, Aazim Akhtar is listed as the Senior Editor for vpnranks.com, but on Zoominfo.com, he’s listed as working at Gaditek as their Team Lead for Content Production:
Lastly, we have Syed Ameer Abbas Rizv, whose rozee.pk job profile shows that he worked for Gaditek from 2014-2018 and worked on bestvpnservice.com, bestvpnprovider.com, and kodivpn.co.
Out of these, vpnranks.com is the most successful, with roughly 2.5 million monthly website visitors, according to SimilarWeb.
Interesting points to consider:
Along our research, we discovered some employees of PureVPN and Gaditek also worked for another VPN provider called OneVPN, which is owned by Unravel Technologies.
Unravel is supposed to be based in Hong Kong, but like PureVPN, its base is actually in Karachi, Pakistan. Muhammad Fahad’s job profile shows him working at first Gaditek then Unravel, both in Karachi:
Then there’s Ashad Zaid’s LinkedIn profile that shows he only worked at Gaditek from 2015-2016, but not Unravel Technologies or OneVPN, but still lists OneVPN (along with Gaditek products PureVPN and Ivacy) as some of the projects he’s worked on:
A likely reason: OneVPN is yet another VPN product that’s owned or operated by Gaditek.
Another interesting point: PureVPN, IvacyVPN, and vpnranks.com all share the same registration address in Singapore. Another company on this list – Innovative Connecting – also has the same address.
They’re likely not connected directly but only using the same accounting company, TMF Group, registered at the same address.
4. Kape Technologies: 4 total VPN products
Kape Technologies is a company with its location in the Isle of Man. In 2017, it acquired Romanian VPN provider CyberGhost VPN, and in October 2018, it acquired the German-based VPN provider ZenMate.
In November 2019, Kape Technologies purchased London Trust Media for $99.5 million, which owns Private Internet Access.
However, the biggest purchase for Kape and the VPN industry overall happened on September 13, 2021. On this day, Kape bought ExpressVPN for nearly $1 bn, doubling its userbase from 3 to 6 million.
What’s more, Kape owns two popular VPN review sites in vpnmentor.com and wizcase.com which allows them to advertise their products in the Top 3. Together, these websites have over 6 million monthly visitors.
First interesting point to consider:
Kape Technologies, up until March 2018, went by a different name: Crossrider. Why the change?
Because Crossrider is well-known for infecting users’ devices with malware and other adware. According to Symantec’s Security Center, the Crossrider program had adware with a high-risk impact. The program replaced ads with its own in browsers, collected personal data, and connected to the Crossrider domain.
Malwarebytes had similar information, warning users that the Crossrider program was involved in browser hijacking, malicious software bundlers, adware, and other monetizing methods.
In fact, Crossrider/Kape CEO Ido Erlichman admitted that changing their name was because of the “strong association of the past activities of the company.”
There are 3 more important points to consider:
1. CyberGhost’s March 2018 Terms and Conditions stated the following:
But the current T&C replaces that with CyberGhost. One can argue that the change was made hectically, forgetting to capitalize the G letter.
Why doesn’t it mention Kape? Also, neither this nor the Crossrider name appears in PIA’s, ZenMate’s, or ExpressVPN’s T&Cs.
2. Crossrider’s Founder and CEO (until March 2016) was Koby Menachemi, who was part of Unit 8200, Israel’s version of the NSA. Ad injection (like the Crossrider program) has been linked to intelligence agencies.
3. The main investor in Crossrider/Kape Technologies is Teddy Sagi, whose name was included in the Panama Papers leak.
Second interesting point to consider:
When looking at this situation, and specifically at their changing T&Cs, there’s an interesting legal question to consider: which jurisdiction wins, the parent company’s or the subsidiary’s?
If the authorities were to approach Kape Technologies, which as an Isle of Man-registered company, is under British legislation, could they force Romanian CyberGhost or American-based PIA to provide logs of its VPN users or to even put in place monitoring systems?
One interesting case that often comes up is when Highwinds (before being acquired by StackPath) was the parent company of IPVanish. Although both in the same jurisdiction, IPVanish claimed no logs but turned over logs it actually kept to Homeland Security.
According to case files, the federal agent issued a summons to IPVanish’s parent company, Highwinds Network Group, which gave clues to help the agent submit a more specific, detailed summons.
The agent then sent the second summons for “any data associated with IRC traffic using IP 22.214.171.124, port 6667.” Highwinds/IPVanish complied.
The question then: if the British authorities approached Kape Technologies and asked them for specific logs on a specific CyberGhost user, would CyberGhost/Kape be able to deny the request?
We asked their customer support, and they denied that possibility:
However, it’s a bit difficult to take anything VPN providers say at face value. After all, IPVanish wasn’t supposed to have any logs to give to the authorities until they approached them. So the question is – how safe the users of Kape-owned VPNs really are?
Third interesting point to consider:
Buying ExpressVPN in September 2021 was no joke. This deal had a significant impact not only on the VPN but on Kape as a company. According to Kape CEO Ido Erlichman, together, they are planning to “take the industry to another level.”
Here are the key points, discussed in detail below:
- ExpressVPN was bought for $936 million in cash
- Adding ExpressVPN doubled Kape’s VPN userbase to 6 million
- ExpressVPN is considered by many to be the top provider, known for security and privacy
$1 billion for a VPN?
The fact that Kape Technologies had such a huge sum at its disposal (leaving behind the fact that the owner Teddy Sagi is a billionaire) will make its competitors reassess this global player in the online security market. It’s hard to tell what was the main source of $122 million revenue in 2020, but it’s unlikely that CyberGhost, PIA, and ZenMate alone pulled this off.
That’s why we get back to the Crossrider times, where all that adware and malware paid off (or is still paying off) pretty well. Also, we don’t know if this was the first attempt to buy ExpressVPN. After all, CyberGhost and Private Internet Access were bought back in 2017 and 2019, respectively.
So if Kape Technologies had plenty of resources back then, why did they wait until 2021 to get ExpressVPN with a significantly bigger price tag? We guess this had to do with their new Lightway and TrustedServer technologies that will benefit other Kape projects beyond VPNs.
The majority of the userbase
Adding 3 million users is a big change for most companies, especially when the new clients now form the majority. Before the deal, Kape had about 2.5 million subscribers. Of course, this means more revenue that will help “pay off” the ExpressVPN price.
At the same time, it means that ExpressVPN is more like the partners and not just another acquisition like ZenMate. After all, they have the technology and know-how that Kape covets, in addition to the $279 million revenue, which rose by 37%. And just like Kape, ExpressVPN is interested in moving beyond the VPN industry.
One question is whether Ligthway, TrustedServer, and anything else that ExpressVPN has upon its sleeve will be integrated into other Kape-owned VPNs, affecting their users and the prices they pay? Knowing that since 2019 CyberGhost and PIA didn’t make any “technology sharing,” such a scenario seems improbable.
No longer on the top?
This deal brings questions about ExpressVPN reputation. As of now, it was often the best VPN and always on the “best of” lists of all kinds. This provider managed to avoid scandals and was known for excellent security and privacy.
There aren’t many VPNs that have their no-logs policy proven in court and independently audited at the same time. And this is what helped ExpressVPN stay at the top despite its ever-increasing prices.
But what happens now when Kape’s poor reputation draws a permanent shadow over the newly bought service? For example, there was a deal with Nokia to preload some of their phones with ExpressVPN. Will it still be honored?
Soon after the purchase by Kape, worrying information about ExpressVPN’s CIO Daniel Gericke appeared. Turns out, he’s a former US military member who illegally worked as a mercenary hacker for UAE, helping create a hacking tool for spying named Karma. What’s more, he was fined $335,000 and agreed to cooperate with US Justice Department and FBI.
Let’s also not forget that Teddy Sagi, one of the Kape founders, worked for Israeli intelligence and was also convicted for inside trading. Both Israel and UAE are US allies.
5. nordvpn s.a.: 3 total VPN products
Up until November 15, 2020, Tefincom S.A. was the company behind NordVPN, NordLayer, and other cybersecurity products. After structural changes in Nord Group, all of them were put under nordvpn s.a. entity, which is registered in Panama.
As you can see, mapping the ownership of these products is a bit complicated. It didn’t get much better after the October 15, 2021 deal that saw Peakstar technologies Inc. product Atlas VPN incorporated into Nordsec Ltd. The latter now controls three VPN products: NordVPN, NordLayer, and Atlas VPN.
Overall, it looks like the beginning of the merging era. Back in September 2021, Kape Technologies bought ExpressVPN for a record sum, making it arguably the largest player in the VPN market. Obviously, getting Atlas VPN won’t be enough for Nordsec Ltd. to compete for the market share. Therefore, don’t be surprised if the company behind NordVPN makes another move in the near future.
The mobile-only VPN market is a bit more straightforward: a lot of VPN developers are producing more than one VPN product.
They’re mostly free VPNs, which means they’re selling ads to users or selling user data to third parties.
6. Innovative Connecting: 10 total VPN products
This Android developer directly makes TurboVPN, VPN Master, VPN Proxy Master Pro, and VPN Proxy Master Lite. It also develops the iOS app VPN Sofast – Mymobilesecure.
Interesting points to consider:
Innovative Connecting has been connected with Lemon Clove as well (in addition to a third company, ALL Connected Co. Ltd). Lemon Clove makes the VPN apps Snap VPN and VPN Robot.
Lemon Clove and Innovative Connecting both have the same secretary and key addresses.
ALL Connected is listed as the App developer on the App Store for TurboVPN and VPN Master, while Innovative appears as the developer on the Play Store for the same apps (plus a back and forth chain of links between their websites and apps on the mobile app stores).
Lemon Clove has a common address with Innovative, and the Secretary for the board is the same (Loo Ping Yoo). The policies for both Turbo and Master VPN are hosted on similar Cloudfront domains, linking to Innovative. But the App Store policy for MasterVPN is hosted on ALL Connected’s domain. The SnapVPN policy is on the same Cloudfront domain. All the policies share the same broken English and typos.
The Director of Innovative appears to be Danny Chen, who is the CEO of Linksure. He appears on a Singapore registry as Director of Innovative shareholding. Yoo Loo Ping is the secretary of both Lemon Clove and Innovative and is a Singapore citizen.
Then there’s the look of both of their websites – which are pretty much identical in design, wording, and everything else but the company’s name.
Here’s Innovative Connecting’s website:
And here’s Lemon Clove’s website:
Beyond that, when looking at the registration information for turbovpn.co, we noticed the domain was registered with a Gmail address. When we looked at other domains registered by [email protected], we noticed that it also listed lemonclove.net, along with Lemon Clove’s vpnsnap.com and Innovative Connecting’s own turbovpn.co and vpnmaster.co:
Why would Lemon Clove hide being affiliated or owned by Innovative Connecting?
Second interesting point to consider
When looking through the APK files for Innovative Connecting/Lemon Clove/All Connected, we discovered the following:
The bottom 5 are already known to us as being under Innovative Connecting:
- “free.vpn.unblock.proxy.vpnpro” – Snap VPN (Lemon Clove)
- “free.vpn.unblock.proxy.freenetvpn” – Freenet VPN (trademarked by All Connected/Innovative Connecting)
- “free.vpn.unblock.proxy.vpnmaster” – VPN Master (Innovative Connecting)
- “free.vpn.unblock.proxy.turbovpn” – TurboVPN (Innovative Connecting)
- “free.vpn.unblock.proxy.vpn.master.pro” – VPN Proxy Master (Innovative Connecting)
However, when we searched for the first one, we found it was the app “Unlimited Free VPN Monster – Fast Secure VPN Proxy” developed by a developer called Autumn Breeze 2018. Digging further, we discovered a reference that this is actually an Innovative Connecting product:
7. SuperSoftTech: 3 total VPN products
This company develops the following apps:
- VPN Payment Tool
- LinkVPN (by way of FuryWeb Tech, another of Jinrong Zheng’s developer names)
Interesting points to consider:
While this is officially owned by the SuperSoftTech company based in Singapore, it actually belongs to the independent app publisher Jinrong Zheng – most likely a Chinese national based in Beijing.
The contact email address on the Play store ([email protected]) links to a Chinese address in Beijing. Jinrong Zheng has released several apps (mostly games) that almost all start with the prefix “Super.”
SuperVPN has been ranked the #3 most malware-rigged VPN app in a 2016 Australian research by Csiro [pdf]:
Interestingly, AnchorFree’s Betternet is listed as #4.
8. Act Mobile Networks: 6 total VPN products
As Act Mobile Networks, it develops the following apps:
- VPN (Dash VPN)
- Dash Net Accelerated VPN
- VPN On – Fastest and Best VPN
This developer shares the same registration address in California with Free VPN LLC, which develops the following apps (iOS and Android):
- Private Browser + USA Wifi VPN
- Free VPN by Free VPN .org™
- VPN Pro + Fast Video Browser
But instead of there being a coincidence, or them using the same accountant or other reason, these companies are very much connected.
Not only do they share the same address, but they also are officers in each other companies:
Most likely, they’re the same company: Actmobile Networks, which is actually not based in California (that’s now inactive) but in Delaware.
Free mobile-only VPNs with Chinese origins
We discovered that a good amount of the free mobile-only VPNs are owned by Chinese companies or companies run by Chinese nationals.
- Innovative Connecting (10 VPN apps): Director Danian “Danny” Chen is a Chinese national (Chen’s LinkSure is the sole shareholder and shares the same address as Innovative Connecting)
- Hotspot VPN (5 VPN apps): Director Zhu Jianpeng has a residential address in Heibei Province in China
- Hi Security (3 apps): the VPN apps are part of Shenzhen HAWK Internet, a subsidiary of the Chinese major company TCL Corporation
- SuperSoftTech (2 apps): while officially owned by Singapore-based SuperSoftTech, it actually belongs to independent app publisher Jinrong Zheng, a Chinese national based in Beijing.
- LEILEI (2 apps): by the titles of the VPNs (all written in Chinese characters), it’s likely that this developer is Chinese or based in China
- Newbreed Network Pte.Ltd (6 apps): again, while it has a Singapore address, the websites for its VPN apps SGreen VPN and NodeVPN are completely in Chinese, while NodeVPN’s site lists the People’s Republic of China as its location.
Free VPNs to protect your personal data online:
Alternative free VPN services for movies:
Tested and working VPNs for movies:
Check out the best VPNs:
Check out our other research:
- Free antivirus apps requesting huge amounts of dangerous permissions they don’t need
- How to beat Google Play’s algorithm and get 280 million installs
- Study: how the world’s top websites track your online behavior
- Who is dominating the rising VPN market in 2019? Here are the numbers
- VPN confidential: how private is your VPN purchase?
- What is port forwarding?
- VPN news roundup
We meticulously research our stories and endeavor to present an accurate picture for our readers. We’re also human, and if you believe we have made a factual error (as opposed to disagreeing with an opinion), please contact us so that we may investigate and either correct or confirm the facts. Please reach out to us by using our Contact Us page.
Jan is the captain at the helm of VPNpro. He ensures that every crew member is practicing perfect digital hygiene and spreading only accurate pro tips about technology. Besides that, he is a frequent contributor on many renowned publications, such as Forbes, ComputerWeekly, PC Mag, TechRadar, and ZDNet.