On the surface, it may seem that the VPN market is teeming with various companies competing for a piece of the growing consumer VPN pie.

However, when we began to look further into the VPNs and the companies that own them, we noticed something interesting: a lot of these products are owned by the same company. With our interests piqued, we decided to dig deeper to see just how many VPN products are owned or operated by which companies.

The number may surprise you:

Our research shows that at least 97 VPN products are owned or operated by only 23 companies.

This includes both cross-platform and mobile-only VPN products. It also includes direct subsidiaries or products/brands, as well as white label services. This represents a much bigger number than was previously reported in other research.

For our analysis, we only included parent companies that own or operate more than one VPN product.

You can find our infographic that summarizes our research here.

Why is this important?

When it comes to the true ownership of various VPN products and brands, it’s important to know which company is actually owning or operating the users’ data. There are two big possible issues to consider.

#1 Data privacy

If the parent companies are actually located in a 5/9/14 Eyes country, which are typically high-surveillance countries, users’ data could be wide open to those governments. If they are in Russia, China, and other authoritarian/repressive governments, they are forced to provide their data to the governments on a default basis (as we discussed before in our Chinese surveillance analysis). The parent company may also be willing to sell user data.

Recently, US senators have planned an investigation into the foreign servers used to redirect traffic when using a VPN. Senators Marco Rubio (R-FL) and Ron Wyden (D-OR) noted the following [pdf]:

“If U.S. intelligence experts believe Beijing and Moscow are leveraging Chinese and Russian-made technology to surveil Americans, surely DHS should also be concerned about Americans sending their web browsing data directly to China and Russia.”

#2 Data security

If the owning company is untrustworthy, it could bring up many problems. Parent companies that have been shown to have major vulnerabilities, or even include suspicious add-ons and possible malware, could lead to user data being stolen, or even their computers being hacked.

Key takeaways

The most important points our research showed:

  • j2 Global (via StackPath) owns or operates at least 10 VPN brands. However, it officially claims to own just 3: IPVanish, StrongVPN and Encrypt.me (formerly Cloak). We show that it provides white label services for VPNHub and NameCheap VPN, and also operates 5 other VPN products
  • Similarly, AnchorFree officially claims only Hotspot Shield, TouchVPN, and JustVPN products. However, it hides the fact that it owns Betternet products as well, for a total of 10 owned VPN products
  • Gaditek, the Karachi-based tech company, officially claims to own just 3 VPN products (PureVPN, Ivacy and the newer Unblock VPN & Proxy). However, we’ve discovered two more VPN products. We also show that this company runs the VPN review sites vpnranks.com, bestvpnservice.com, bestvpn.co, and 2 others
  • The popular mobile VPN developer Innovative Technologies has 10 VPN products under its belt. We show that 2 of those VPN products are by its other company, Lemon Clove, and another 2 by Autumn Breeze 2018, which it also owns
  • American company Actmobile Networks, with 3 VPN mobile apps, also runs or operates Free VPN LLC, for a total of 6 VPN products
  • We show that most of the popular mobile-only VPNs are actually Chinese (run by Chinese nationals or actually located in China). This means user data is likely open to Chinese authorities, confirming US Senators’ fears of American data falling into Chinese or Russian hands

You can view the full summary of our findings in our detailed infographic. Below you can see how many of these VPN products are available in both the Google Play and Apple App stores.

#1 j2 Global (via StackPath) – 10 total VPN offerings

j2 Global's mobile app offerings, via StackPath
j2 Global’s mobile app offerings, via StackPath

j2 Global (which also owns the tech publication PCMag, amongst others) recently acquired StackPath, which is listed as “an American content delivery network, cloud service and web application firewall provider.” In an attempt to broaden its offerings,  StackPath purchased Highwinds in 2017, and along with that came IPVanish, StrongVPN and Encrypt.me (formerly Cloak).

Through its white label section, WLVPN, which StackPath purchased in 2016, it offers white label VPN services for both VPNHub (Pornhub’s VPN) and Namecheap VPN. Reddit users discovered that NameCheap VPN uses the WLVPN service.

On WLVPN’s website, they list the Overplay VPN service as one of their customers as well.

wlvpn partner list

Based on DNS server addresses, Unblock-Us is also connected to WLVPN/Highwinds, and owned or operated by StackPath or CEO Lance Crosby.

In fact, through Crosby we can connect these other VPNs as well:

First interesting point raised:

Unblock-us is not listed as being a client of WLVPN or having any affiliation with Highwinds or StackPath.

However, when looking at the instructions for setting up Unblock-us on Windows, we find these DNS server addresses.

unblock-us highwinds

They are both connected to the Highwinds organization.

DNS 1: 64.145.73.5

isp-organization highwinds marked

DNS 2: 209.107.219.5

isp-organization highwinds dns2 marked

Besides the DNS server clue, a look at their employee’s LinkedIn profiles also reveal some interesting trends:

Peter Gratale’s LinkedIn profile shows that he worked at both Unblock US and Highwinds from 2014 to 2016:

Second interesting point raised:

You may have noticed two different names for the same Unblock-Us service: UnblockUS and Unblock-Us. There are two separate LinkedIn pages for these “companies”: UnblockUS and Unblock-Us, which leads us to a company called NetProtect. However, both of these company pages list the website www.unblock-us.com as their domain, which is the actual website for the Unblock-Us VPN service.

Both unblock-us.com and netprotect.com have the same favicon:

Unblock-Us has the following address listed at the bottom of its website:

NetProtect Ltd, 236 Strovolos Avenue, Strovolos, 2048, Nicosia, Cyprus

When looking at NetProtect’s website, we see the following two addresses listed:

Worldwide: 21 Pine Road, Belleville, St Michael, BB11113, Barbados | EU: NetProtect Ltd, Grigori Afxentiou, 133 Agios Dometios, 2369, Nicosia Cyprus

They show the same company name (NetProtect Ltd.) with slightly different addresses in Cyprus. However, when you go to this URL: https://promo.unblock-us.com/welcome, you’ll see the exact same two addresses from NetProtect’s website.

And when we took a look at the Barbados address, we discovered that there were in fact 96 entities registered at the same address (thanks to the Panama Papers). None of them are NetProtect or Unblock-us.

At this point, it’s safe to say that they’re both the same company.

And to connect it all back to StackPath, just in case we haven’t proven our point yet: There’s a company called Netprotect LLC that is registered in Florida. Here are the key people in that company:

lance crosby netprotect llc

If that name looks familiar to you, it’s because that’s the same Lance Crosby…

lance crosby netprotect llc 1

…who owns Highwinds Network Group…

lance crosby netprotect llc 2

…as well as StackPath, Overplay, Strong Technology (StrongVPN) and many other companies.

#2 AnchorFree – 10 total VPN products

AnchorFree mobile VPN products
AnchorFree mobile VPN products

AnchorFree has been involved in the VPN industry since introducing its main product, Hotspot Shield, in 2008. In February 2015, AnchorFree acquired JustVPN and TouchVPN. JustVPN has just one VPN product: an Android app called “JustVPN – Free Unlimited VPN & Proxy.”

TouchVPN has three unique apps. Two are for Android (Touch VPN, VPN 360), and three are for iOS: VPN 360, Touch VPN, VeePee VPN Proxy.

In November, 2016, Betternet Technologies was acquired by AnchorFree. Betternet creates the following apps:

Android:

  • VPN Free – Betternet Hotspot VPN & Private Browser
  • VPN Proxy by HexaTech
  • VPN in Touch (developer listed as just “Betternet”)

iOS:

  • Best VPN Proxy Betternet
  • HexaTech Unlimited VPN
  • VPN in Touch
  • VPN Pro | Lifetime Proxy & Best VPN by Betternet

Eliminating duplicate iOS and Android apps (with different names), we see that AnchorFree has 10 total VPN products, including unique app offerings.

Interesting points raised:

Coming to the conclusion that AnchorFree acquired Betternet was a task in and of itself. You see, there’s no record of that acquisition ever having happened. So how do we know Betternet is owned by AnchorFree?

A couple of things.

First, the biggest proof is Betternet’s own privacy policy. There, AnchorFree is very visibly shown to be the company behind Betternet. However, when looking at AnchorFree’s mergers and acquisitions on competitor intelligence website Owler.com, we see the JustVPN and TouchVPN as the only acquisitions by AnchorFree:

AnchorFree listed acquisitions

Now, the main question: why did AnchorFree put out a press release for its acquisition of JustVPN and TouchVPN, but not for Betternet? In fact, why is there no direct information at all about this acquisition (company blog posts, press releases, mentions in interviews, articles, etc.), even though this information is readily available?

This is most probably related to all the bad news surrounding Betternet – and research showing that it’s one of the worst VPN providers out there.

#3 Gaditek: 7 total VPN products

Gaditek mobile VPN products
Gaditek’s mobile VPN products

Gaditek is a Pakistan-based company that owns PureVPN, Ivacy, and Unblock – a newer VPN and proxy product.

An interesting point is that this “New Age” company also has interesting marketing practices. The employees of Gaditek/PureVPN have also been connected to the following VPN review sites:

  • vpnranks.com
  • bestvpnservice.com
  • kodivpn.co
  • bestvpn.co (previously bestvpnprovider.com)
  • usavpn.com

This is a profile from Humayoun Khan, who worked at Gaditek from 2014-2015 and wrote “unbiased VPN reviews” for vpnranks.com, netflixdown.com and bestvpnprovider.com:

Humayoun Khan profile

Additionally, Aazim Akhtar is listed as the Senior Editor for vpnranks.com, but on Zoominfo.com, he’s listed as working at Gaditek as their Team Lead for Content Production:

Aazim akhtar

Lastly, we have Syed Ameer Abbas Rizv whose rozee.pk job profile shows that he worked for Gaditek from 2014-2018 and worked on bestvpnservice.com, bestvpnprovider.com, and kodivpn.co.

Out of these, vpnranks.com is the most successful, with roughly 2.5 million monthly website visitors, according to SimilarWeb.

Interesting points to consider:

Along our research, we discovered some employees of PureVPN/Gaditek also worked for another VPN provider called OneVPN, which is owned by Unravel Technologies.

Unravel is supposed to be based in Hong Kong, but like PureVPN, its base is actually in Karachi, Pakistan. Muhammad Fahad’s job profile shows him working at first Gaditek then Unravel, both in Karachi:

Myhammad Fahad gaditek unravel

Then there’s Ashad Zaid’s LinkedIn profile that shows he only worked at Gaditek from 2015-2016, but not Unravel Technologies or OneVPN, but still lists OneVPN (along with Gaditek products PureVPN and Ivacy) as some of the projects he’s worked on:

OneVPN part of PureVPN

A likely reason: OneVPN is yet another VPN product that’s owned or operated by Gaditek.

Another interesting point: PureVPN, IvacyVPN and vpnranks.com all share the exact same registration address in Singapore. Another company on this list – Innovative Connecting – also has the same address.

It is likely they’re not connected directly, but only using the same accounting company, TMF Group, which is registered at the same address.

#4 Kape Technologies: 2 total VPN products

KapeTechnologies mobile VPN offerings
KapeTechnologies mobile VPN offerings

Kape Technologies is a company with its location in the Isle of Man. In 2017, it acquired Romanian VPN provider CyberGhost VPN, and in October 2018 it acquired the German-based VPN provider ZenMate.

First interesting point to consider:

Kape Technologies up until March 2018 went by a different name: Crossrider. Why the change?

Because Crossrider is well-known for infecting users’ devices with malware and other adware. According to Symantec’s Security Center, the Crossrider program had adware with a high risk impact. The program was able to replace ads with its own in browsers, collect personal data and connect to the crossrider domain.

Malwarebytes had similar information, warning users that the Crossrider program was involved in browser hijacking, malicious software bundlers, adware and other monetizing methods.

In fact, Crossrider/Kape CEO Ido Erlichman admitted that changing their name was because of the “strong association of the past activities of the company.”

There are 3 more important points to consider:

1. CyberGhost’s March 2018 Terms and Conditions stated the following:

cyberghost crossrider t&c

But the current T&C replaces that with CyberGhost.

cyberghost crossrider t&c 2019

Why doesn’t it mention Kape?

2. Crossrider’s Founder and CEO (until March 2016) was Koby Menachemi, who was part of Unit 8200, Israel’s version of the NSA. Ad injection (like the Crossrider program) has been linked to intelligence agencies.

3. The main investor in Crossrider/Kape Technologies is Teddy Sagi, whose name was included in the Panama Papers leak.

Second interesting point to consider:

When looking at this situation, and specifically at their changing T&Cs, there’s an interesting legal question to consider: which jurisdiction wins, the parent company’s or the subsidiary’s?

If the authorities were to approach Kape Technologies, which as an Isle of Man-registered company is under British legislation, could they force Romanian CyberGhost to provide logs of its VPN users, or to even put in place monitoring systems?

One interesting case that often comes up is when Highwinds (before being acquired by StackPath) was the parent company of IPVanish. Although both in the same jurisdiction, IPVanish claimed no logs, but turned over logs it actually kept to Homeland Security.

According to case files, the federal agent issued a summons to IPVanish’s parent company, Highwinds Network Group, which gave clues to help the agent submit a more specific, detailed summons.

The agent then sent the second summons for “any data associated with IRC traffic using IP 209.197.27.72, port 6667.” Highwinds/IPVanish complied.

The question then: if the British authorities approached Kape Technologies and asked them for specific logs on a specific CyberGhost user, would CyberGhost/Kape be able to deny the request?

We asked their customer support, and they denied that possibility:

CyberGhost Support 1

CyberGhost Support 2

CyberGhost Support 3

However, it’s a bit difficult to take anything VPN providers say at face value. After all, IPVanish wasn’t supposed to have any logs to give to the authorities – until they were approached by the authorities.

Mobile-only apps

The mobile-only VPN market is a bit more straightforward: a lot of VPN developers are producing more than one VPN product.

They’re mostly free VPNs, which means that they’re selling ads to users, or selling user data to third-parties.

#5 Innovative Connecting: 10 total VPN products

Innovative Connecting mobile VPN products
Innovative Connecting mobile VPN products

This Android developer directly makes TurboVPN, VPN Master, VPN Proxy Master Pro and VPN Proxy Master Lite. It also develops the iOS app VPN Sofast – Mymobilesecure.

Interesting points to consider:

Innovative Connecting has been connected with Lemon Clove as well (in addition to a third company, ALL Connected Co. Ltd). Lemon Clove makes the VPN apps Snap VPN and VPN Robot.

Lemon Clove and Innovative Connecting both have the same secretary and key addresses.

ALL Connected is listed as the App developer on the App Store for TurboVPN and VPN Master, while Innovative appears as the developer on the Play Store for the same apps (plus a back and forth chain of links between their websites and apps on the mobile app stores).

Lemon Clove has a common address with Innovative and the Secretary for the board is the same (Loo Ping Yoo). The policies for both Turbo and Master VPN are hosted on similar Cloudfront domains, linking to Innovative. But the App Store policy for MasterVPN is hosted on ALL Connected’s domain.The SnapVPN policy is on the same Cloudfront domain. All the policies share the same broken English and typos.

The Director of Innovative appears to be Danny Chen, who is the CEO of Linksure. He appears on a Singapore registry as Director of Innovative shareholding. Yoo Loo Ping is the secretary of both Lemon Clove and Innovative and is a Singapore citizen.

Then there’s the look of both of their websites – which are pretty much identical in design, wording, and everything else but the name of the company.

Here’s Innovative Connecting’s website:

And here’s Lemon Clove’s website:

side-by-side lemonclove

Beyond that, when looking at the registration information for turbovpn.co, we noticed the domain was registered with a Gmail address. When we looked at other domains registered by [email protected], we noticed that it also listed lemonclove.net, along with Lemon Clove’s vpnsnap.com and Innovative Connecting’s own turbovpn.co and vpnmaster.co:

lemonclove innovative connecting

Why would Lemon Clove hide being affiliated or owned by Innovative Connecting?

Second interesting point to consider

When looking through the APK files for Innovative Connecting/Lemon Clove/All Connected, we discovered the following:

Innovative Connecting - Autumn Breeze 2018

The bottom 5 are already known to us as being under Innovative Connecting:

  • “free.vpn.unblock.proxy.vpnpro” – Snap VPN (Lemon Clove)
  • “free.vpn.unblock.proxy.freenetvpn” – Freenet VPN (trademarked by All Connected/Innovative Connecting)
  • “free.vpn.unblock.proxy.vpnmaster” – VPN Master (Innovative Connecting)
  • “free.vpn.unblock.proxy.turbovpn” – TurboVPN (Innovative Connecting)
  • “free.vpn.unblock.proxy.vpn.master.pro” – VPN Proxy Master (Innovative Connecting)

However, when we searched for the first one, we found it was the app “Unlimited Free VPN Monster – Fast Secure VPN Proxy” developed by a developer called Autumn Breeze 2018. Digging further, we discovered a reference that this is actually an Innovative Connecting product:

Innovative Connecting - Autumn Breeze VPN Monster

#6 SuperSoftTech: 3 total VPN products

SuperSoftTech mobile VPN offerings
SuperSoftTech mobile VPN offerings

This company develops the following apps:

  • SuperVPN
  • VPN Payment Tool
  • LinkVPN (by way of FuryWeb Tech, another of Jinrong Zheng’s developer names)

Interesting points to consider:

While this is officially owned by the SuperSoftTech company that’s based in Singapore, it actually belongs to the independent app publisher Jinrong Zheng – most likely a Chinese national based in Beijing.

The contact email address on the Play store ([email protected]) links to a Chinese address in Beijing. Jinrong Zheng has released several apps (mostly games) that almost all start with the prefix “Super.”

SuperVPN has been ranked the #3 most malware-rigged VPN app in a 2016 Australian research by Csiro [pdf]:

SuperVPN malware

Interestingly, AnchorFree’s Betternet is listed as #4.

#7 Act Mobile Networks: 6 total VPN products

Act Mobile Networks mobile VPN products
Act Mobile Networks mobile VPN products

As Act Mobile Networks, it develops the following apps:

  • VPN (Dash VPN)
  • Dash Net Accelerated VPN
  • VPN On – Fastest and Best VPN

Interesting points:

This developer shares the same registration address in California with Free VPN LLC which develops the following apps (iOS and Android):

  • Private Browser + USA Wifi VPN
  • Free VPN by Free VPN .org™
  • VPN Pro + Fast Video Browser

But instead of there being a coincidence, or them using the same accountant or other reason, these companies are very much connected.

Not only do they share the same address, but they also are officers in each other companies:

free vpn llc actmobile networks 1

free vpn llc actmobile networks 2

Most likely, they’re the same company: Actmobile Networks, which is actually not based in California (that’s now inactive), but in Delaware.

Free mobile-only VPNs with Chinese origins

We discovered that a good amount of the free mobile-only VPNs are owned by Chinese companies, or companies run by Chinese nationals.

These include:

  • Innovative Connecting (10 VPN apps): Director Danian “Danny” Chen is a Chinese national (Chen’s LinkSure is the sole shareholder and shares the same address as Innovative Connecting)
  • Hotspot VPN (5 VPN apps): Director Zhu Jianpeng has a residential address in Heibei Province in China
  • Hi Security (3 apps): the VPN apps are part of Shenzhen HAWK Internet, a subsidiary of the Chinese major company TCL Corporation
  • SuperSoftTech (2 apps): while officially owned by Singapore-based SuperSoftTech, it actually belongs to independent app publisher Jinrong Zheng, a Chinese national based in Beijing.
  • LEILEI (2 apps): by the titles of the VPNs (all written in Chinese characters), it’s likely that this developer is Chinese or based in China
  • Newbreed Network Pte.Ltd (6 apps): again, while it has a Singapore address, the websites for its VPN apps SGreen VPN and NodeVPN are completely in Chinese, while NodeVPN’s site lists the People’s Republic of China as its location.