In an age where online privacy is a growing concern, virtual private networks (VPNs) have become a popular way to bypass geographical restrictions and protect user data. One option available to many is SetupVPN, a Chrome plugin offering both free and premium versions for secure browsing. But how exactly does SetupVPN work, and what potential risks should organizations and individuals consider? Let’s dive into the facts and discuss how ThreatSTOP’s proactive protections can help.

Understanding SetupVPN

Free and Premium Versions

SetupVPN provides a free version giving users access to 11 servers, whereas its premium tier offers 40 servers with faster speeds and SSL encryption. While this range of server locations and straightforward interface can be attractive to many users, it’s worth noting that advanced features—like specialized leak protection or multi-hop routing—are not part of the package.

Data Collection and Privacy Policy

Despite promising robust privacy safeguards, SetupVPN’s Privacy Policy indicates the collection of quite a bit of user information, including:

• Email address, name, home address, telephone number

• Browser details, search engine use, keywords entered

• Cookies to track pages viewed, links clicked, and actions taken

• Standard data such as IP address, browser type/language, access times, and referring URLs

SetupVPN states that it uses this information for site and service improvements, and for contacting users with service updates or payment reminders. However, third-party links accessed within their service can expose users to different policies and data practices beyond SetupVPN’s control.

Potential for Security Control Bypass

A VPN can be a double-edged sword in a corporate or institutional environment. While it may legitimately help users sidestep geographical blocks for research and communication, SetupVPN can also bypass organizational security controls, hiding online activity from standard oversight. From an IT security standpoint, this is a key point: once traffic is tunneled through SetupVPN, monitoring and filtering at the network perimeter become more challenging.  ThreatSTOP is not saying that SetupVPN is bad.  We're merely informing our users on how it could be used.

Dynamic DNS Indicators

Interestingly, SetupVPN appears to use dynamic DNS under various domains like byny.mouse.pics, uaya.mouse.pics, and wwvj.mouse.pics. Passive DNS information suggests a rotating DNS/IP relationship, which can further mask or shuffle where traffic is being directed. Such tactics underscore how VPN providers can obscure a significant portion of traffic flow—both a benefit to legitimate privacy seekers and a hurdle for security teams aiming to maintain compliance and data integrity.

ThreatSTOP’s Proactive Protections

At ThreatSTOP, our commitment is straightforward: we empower organizations of all sizes to proactively protect their digital environments from malicious activities and inadvertent threats alike. Our ThreatSTOP Security, Intelligence, and Research team continuously refines the protections we deliver—covering command and control, invalid traffic, peer-to-peer communication, data exfiltration, phishing, spam, DDoS activities, and more.

Protective DNS

  • DNS Defense Cloud: By routing your DNS queries through ThreatSTOP’s Cloud DNS service, you benefit from accurate, real-time threat intelligence without needing additional hardware on-premises.
  • DNS Defense: For those who prefer hosting their own DNS servers, DNS Defense seamlessly integrates ThreatSTOP’s intelligence into your existing network infrastructure.

These solutions extend coverage to suspicious or malicious DNS tunnels. In particular, we categorize SetupVPN usage and related domains under our “DNS Tunnel” target, part of our "Command and Control" bundle, offering the visibility and control organizations need. With ThreatSTOP’s Protective DNS in place, malicious or unauthorized VPN usage—whether for data exfiltration or bypassing legitimate security policies—can be prevented or quickly identified.

A Secure Path Forward

VPNs like SetupVPN undeniably offer convenient solutions to common browsing hurdles. Yet understanding how these services operate, what data they collect, and why they might be used to bypass security controls is crucial for individuals and organizations looking to safeguard their networks and personal data. At ThreatSTOP, we believe in empowering teams with proactive protections that adapt to the evolving threat landscape—so you can keep your users safe while maintaining the freedom that online connectivity demands.

If you're interested in becoming part of the ThreatSTOP community or want to explore our proactive protection solutions for various environments, we encourage you to check out our product page. Learn how our offerings can transform your digital security landscape. We offer pricing options to suit businesses of all sizes! Start with a Demo today!

Connect with Customers, Disconnect from Risks

MITRE ATT&CK

MITRE ATT&CK Technique

Technique ID

Explanation

Command and Control: Encrypted Channels

T1573

VPNs, including SetupVPN, can encrypt traffic, making it difficult for defenders to monitor or inspect communications at the network level.

Command and Control: Dynamic Resolution

T1568.002

The use of dynamic DNS domains (e.g., byny.mouse.pics, uaya.mouse.pics) by SetupVPN can help obscure traffic destinations and prevent easy detection.

Defense Evasion: Protocol Tunneling

T1572

SetupVPN tunnels traffic through its servers, bypassing organizational security controls like firewalls or web proxies.

Defense Evasion: Application Layer Protocol

T1071

By operating over common protocols such as HTTPS, SetupVPN can evade network-based detections that rely on non-standard protocol usage for identification.

Exfiltration: Exfiltration Over Alternative Protocol

T1048.003

VPNs like SetupVPN can potentially be used for data exfiltration by tunneling sensitive data through encrypted channels.

Discovery: Network Service Scanning

T1046

SetupVPN or other VPN services could theoretically assist in scanning external networks by masking the origin IP of the scanner.

Discovery: Network Topology Discovery

T1590.006

VPN usage may obscure the discovery of network boundaries, as attackers can hide behind dynamically assigned VPN IPs.

Collection: Data from Local System

T1005

SetupVPN collects user data, including browsing habits and keywords entered, which could be leveraged for malicious purposes or user profiling.

Collection: Input Capture

T1056

The collection of keywords entered (as per the Privacy Policy) might involve monitoring user input, raising potential concerns for sensitive data leakage.

Impact: Data Manipulation

T1565

Third-party links accessed via SetupVPN could manipulate user data or compromise privacy through policies not controlled by the VPN provider.