[chmod775]

The company behind this appears to be "real" and incorporated in Delaware.

> Urban Cyber Security INC

https://opencorporates.com/companies/us_de/5136044

https://www.urbancybersec.com/about-us/

I found two addresses:

> 1007 North Orange Street 4th floor Wilmington, DE 19801 US

> 510 5th Ave 3rd floor New York, NY 10036 United States

and even a phone number: [phone]

https://www.manhattan-nyc.com/businesses/urban-cyber-securit...

They look really legitimate on the outside, to the point that there's a fair chance they're not aware what their extension is doing. Possibly they're "victim" of this as well.

[swatcoder]

> They look really legitimate on the outside

If that looks use-italics "really legitimate" to you, then you might be easily scammed. I'm not saying they're not legitimate, but nothing that you shared is a strong signal of legitimacy.

It would take a perhaps a few hundred dollars a month to maintain a business that looked exactly like this, and maybe a couple thousand to buy one that somebody else had aged ahead of time. You wouldn't have to have any actual operations. Just continuously filed corporate papers, a simple brochure website, and a couple virtual office accounts in places so dense that people don't know the virtual address sites by heart.

Old advice, but be careful believing what you encounter on the internet!

[ch2026]

https://www.manhattanvirtualoffice.com/

The NY address is a virtual office.

https://themillspace.com/wilmington/

The DE address is a virtual office plus coworking facility.

[azinman2]

Wow the virtual office concept is so beyond shady. I wonder if there are any legitimate uses of it?

[ryanjshaw]

Many:

You run a business from home but do not want to reveal you personal address to the world.

You are from a country that Stripe doesn’t support but need to make use of their unique capabilities like Stripe Connect, then you might sign up for Stripe Atlas to incorporate in the USA so you can do business directly with Stripe. Your US business then needs a US physical address ie virtual office.

Etc

[nl]

Virtual offices have been around forever and aren't really an indication of being shady necessarily.

[victorbjorklund]

That you don’t need an office if your company works remotely? Kind of overkill with a whole office for a company with 3 people working at it and everyone works remotely.

[SoftTalker]

Some things still require a mailing address. PO Box isn't always acceptable. Do you want it to be one of your 3 people's houses? What if one moves?

[fc417fc802]

Obvious option would be the law firm handling your business license. But can we also take a minute to appreciate the absurdity of a PO box ever being deemed unacceptable? It literally exists for this exact purpose, and there are any number of "PO box except not a PO box" schemes out there due to this issue. It ought to be illegal to treat PO boxes differently IMO.

[SoftTalker]

Mainly they want an address if they need to serve legal notice to you. You can't deliver that to a PO box, it has to be handed to someone at a physical address.

[Mistletoe]

Amazing.

[Nevermark]

> Urban VPN is operated by Urban Cyber Security Inc., which is affiliated with BiScience (B.I Science (2009) Ltd.), a data broker company.

> This company has been on researchers' radar before. Security researchers Wladimir Palant and John Tuckner at Secure Annex have previously documented BiScience's data collection practices. Their research established that:

> BiScience collects clickstream data (browsing history) from millions of users Data is tied to persistent device identifiers, enabling re-identification The company provides an SDK to third-party extension developers to collect and sell user data

> BiScience sells this data through products like AdClarity and Clickstream OS

> The identical AI harvesting functionality appears in seven other extensions from the same publisher, across both Chrome and Edge:

Hmm.

> They look really legitimate on the outside

Hmm, what, no.

We have a data collection company, thriving financially on lack of privacy protections, indiscriminant collection and collating of data, connected to eight data siphoning "Violate Privacy Network" apps.

And those apps are free... Which is seriously default sketchy if you can't otherwise identify some obviously noble incentives to offer free services/candy to strangers.

Once is happenstance, twice is coincidence, three (or eight) times is enemy action.

The only thing that could possibly make this look any worse is discovering a connection to Facebook.

[mortarion]

Israeli company. No doubt some Mossad front.

[weird-eye-issue]

You can get a mailing address and phone number for like $15/mo. You can incorporate a US business for only a couple hundred dollars.

[bix6]

Is the agent address real?

1000 N. WEST ST. STE. 1501, WILMINGTON, New Castle, DE, 19801

It almost matches this law firms address but not quite.

https://www.skjlaw.com/contact-us/

Brandywine Building 1000 N. West Street, Suite 1501 Wilmington DE 19801

[thayne]

Being a real business doesn't necessarily mean they can be trusted. Real companies do shady stuff all the time.

[consp]

This also works in reverse: shady companies do real business. While the reason might be different the end result is the same.

[throw310822]

> Urban VPN is operated by Urban Cyber Security Inc., which is affiliated with BiScience (B.I Science (2009) Ltd.), a data broker company.

BiScience is an Israeli company.

[hnbad]

Israel is the new Russia, I guess.

[elisbce]

Judging from their website, all links eventually point to either the VPN extension download website, or a signup link. I'm not surprised if some nation state supported APT is behind this shit.