Gateway security inspection, policy oversights, and academic access report
Identified configuration gaps that allow perimeter filtering controls to be bypassed
| Vulnerability | Risk Level | Details & Operational Impact |
|---|---|---|
| Microsoft Edge Add-ons Store Open microsoftedge.microsoft.com/addons | High | Access to the official Edge extension repository is unblocked. Users can install browser proxy extensions directly to bypass captive portal limits without needing administrator credentials on the computer. |
| Chrome & Mozilla Add-on Hubs Accessible chromewebstore.google.com / addons.mozilla.org | High | Allows users on alternative browsers to add one-click proxy utilities that wrap outbound web traffic in encrypted HTTPS tunnels, sidestepping Sophos web category restrictions. |
| Encrypted DNS Enabled in Browsers DNS-over-HTTPS (DoH) | High | Modern browsers send encrypted domain name queries directly to public resolvers (such as Cloudflare or Google). This hides visited domains from local gateway monitors unless public DoH servers are restricted. |
| Public Web Translators Operating as Proxies translate.google.com / bing.com/translator | Medium | Users can submit restricted URLs into web translation portals. The third-party server fetches and displays the page content within its own allowed frame. |
| Dual-Stack IPv6 Bypass Unrestricted IPv6 Network Interface | Medium | If web categorization rules are bound strictly to IPv4 routing, destinations reachable over native IPv6 connections may bypass captive portal policies entirely. |
| Public Web Snapshot & Archive Mirrors archive.org / webcache.googleusercontent.com | Low | Enables browsing cached snapshots of restricted research or academic materials without establishing a direct link to the original blocked server. |
Domain endpoints and fallback routing infrastructure utilized by common browser add-ons
| Extension Name | Primary Endpoints & Auth | Fallback Endpoints & Node Hosts |
|---|---|---|
| 1VPN Edge & Chrome Add-on |
api.1vpn.org
1vpn.org / auth.1vpn.org
|
cdn.1vpn.org / *.1vpn.org
Egress servers hosted on DigitalOcean, OVHcloud, and Hetzner VPS pools.
|
| Urban VPN Proxy Universal Browser Add-on |
api-pro.urban-vpn.com
authentication.urban-vpn.com
config.urban-vpn.com
|
*.urban-vpn.com
config-toolbar.urban-vpn.com
Peer-assisted relay network with regional hostnames (p-*.urban-vpn.com).
|
| Touch VPN Chrome, Edge & Firefox |
touchvpn.net / api.touchvpn.net
backend.northghost.com
|
*.touchvpn.net / *.northghost.com
Upstream infrastructure operated through Pango / AnchorFree cloud relays.
|
| ZenMate VPN Multi-Platform Add-on |
zenmate.com / api.zenmate.com
auth.zenmate.com
|
*.zenguard.biz / *.zenmate.info
Tunnel egress operated through CyberGhost / Kape server networks.
|
| SetupVPN Browser Extension Proxy |
setupvpn.com / api.setupvpn.com
|
*.setupvpn.com
Backup proxy controllers hosted on Linode and Leaseweb IP pools.
|
Verified essential destinations misclassified by filters, creating motivation for VPN usage
| Website | Category | Observations & Bypass Incentive |
|---|---|---|
| typingtest.me/certificate | Skill Certification | Legitimate platform used by students to practice keyboard efficiency and generate verified certificates. Filtering this forces students to seek proxy methods. |
| nda.nic.in | National Defence Portal | Official National Defence portal hosted under the government .nic.in domain. Misclassified by automated filtering, interrupting research and career inquiries. |