Universe Browser / 寰宇瀏覽器
ub66.com — "哪里都能去！" (go anywhere)

1 · What the site claims

The landing page is a single static screen with three promises and a download button:

It is served in five languages — Simplified Chinese, Traditional Chinese, English, Korean and Vietnamese — which matches the audience the researchers describe: users across Asia trying to reach sites blocked or illegal in their own jurisdiction.

2 · What independent researchers found

Infoblox and UNODC reverse-engineered the Windows build. Their findings were covered by WIRED, Android Authority and Gadgets 360. Their conclusion: the features are "consistent with remote access trojans (RATs) and other malware."

3 · What I verified myself

Independent inspection of the live site and the current binaries on 19 October 2026, without executing anything. This section is my own evidence; it corroborates the research above and adds detail the press coverage did not have.

3.1 · Hosting and registration

3.2 · The download chain

The download button does not link to a file. It goes to a gate page that runs a fake CAPTCHA and then looks up the payload path from a JSON manifest:

What files/files.json currently returns:

{"windows": "files/2lDT9zYtHf2hdZvAarEhmA/UB-Launcher.exe",
 "android": "files/2lDT9zYtHf2hdZvAarEhmA/UniverseBrowser.apk",
 "ios":     "https://apps.apple.com/cn/app/…id1541131030"}

3.3 · The payload host mints a new timestamp on every request

cdn.n4dhx7bt.com is an eight-character random domain registered 2021-09-29 at GoDaddy, delegated to throwaway-looking name servers (snm1z3c.88ylccne.com), fronted by CloudFront. Requesting the same APK three times in six seconds:

The file does not change (identical Content-Length every time) — the header is generated from the clock at request time. The effect: every download looks like a freshly built, never-before-seen file. Cache validation, "have I seen this binary" reputation lookups and timestamp correlation against a known sample all stop working. This is a deliberate anti-forensics measure, and it is not something a legitimate software CDN does.

3.4 · The Windows "launcher"

The file is named a launcher and is packaged with UPX, which compresses the executable so its real code and strings are not visible until it decompresses itself in memory. UPX is a legitimate packer, but on a consumer download with no code signature it is the standard way to make static analysis and signature-based antivirus fail. This matches the researchers' observation that the browser "covertly installs several programs" — a launcher is exactly the component that fetches and installs the rest.

3.5 · The Android package identifies its owner in the code

UniverseBrowser.apk is 131,428,100 bytes, 6,078 files, built on a Chromium base (lib/arm64-v8a/libchrome.so, SplitChromeApplication) — version string 120.0.0.2102. Its identity fields resolve the ownership question outright:

The certificate and the package name are hard, first-party evidence for the link the researchers established from web infrastructure: the app is a BBIN product, signed by a developer in Taiwan. There is no third party to blame here.

3.6 · Permissions: far beyond what a browser needs

A browser needs the network, storage and notifications. This one also asks for:

Taken one at a time each has a story. Taken together — contacts, accounts, credentials, precise location, silent downloads, ability to install further apps, autostart — the set describes a data-collection and payload-delivery platform that happens to render web pages.

3.7 · Inside the "acceleration technology": an SSH tunnel written in Go

The claimed "寰宇独家线路加速技术" (exclusive line-acceleration technology) is lib/arm64-v8a/libgojni.so — a 14 MB Go library whose internal package paths (normally stripped in release builds) are intact:

/gomobile/src/ub66.com/HttpProxy/dududu/pkg/tunnel/ssh.go
/gomobile/src/ub66.com/HttpProxy/dududu/pkg/tunnel/tunnel.go
/gomobile/src/ub66.com/HttpProxy/dududu/pkg/failover/txt_lookup.go
/gomobile/src/ub66.com/HttpProxy/dududu/pkg/secretutil/rc4.go
/gomobile/src/ub66.com/HttpProxy/dududu/pkg/secretutil/teapotparser.go
/gomobile/src/ub66.com/HttpProxy/dududu/pkg/route/route.go
/gomobile/src/ub66.com/HttpProxy/dududu/pkg/forwarder/forwarder.go

Read together, that is the whole architecture, and none of it is "acceleration":

• tunnel/ssh.go — the proxy is carried over SSH tunnels (it links golang.org/x/crypto/ssh). Your HTTP traffic is wrapped in an SSH session to their server, so it leaves your network looking like an SSH connection, not a web request.
• secretutil/rc4.go + teapotparser.go — a custom framing protocol internally called "teapot" with RC4 obfuscation. RC4 is cryptographically broken and deprecated everywhere else; here its job is to hide the traffic from inspection, not to protect it.
• failover/txt_lookup.go — the client finds its proxy servers through DNS TXT records. That is a takedown-resistance design: block or seize a host, change one TXT record, every installed client migrates. It also means the server list is invisible in the page source, the store listing, and to anyone who doesn't query TXT.
• route/route.go — maintains a local database of the domains you visit (formatAndHashDomain, getRootDomain, an SQLite store). The client keeps a record of your browsing destinations on disk.

"hhpnzkm1dcgb4jgds9w5kk41c8k8qf63"
"vggo8v3u1fs7rv3or2fhc7rmej"

3.8 · Where the tunnel actually goes: Alibaba Cloud, mainland China

The library contains hardcoded server addresses and a bootstrap resolver. Geolocating them:

This is the concrete form of the researchers' "routes traffic through servers in China": at least two hardcoded proxy endpoints sit on Alibaba Cloud in Shenzhen, mainland China, with a Hong Kong node and a Chinese DNS resolver baked in. Combined with the SSH + RC4 + TXT design, the picture is a private, obfuscated, China-rooted tunnel that the operator can re-point at will — and every byte you browse inside this browser passes through it in the clear at the exit.

3.9 · The iOS version and the app-store footprint

The bundle identifier com.bbin.Titanic and the developer certificate O=bbin agree: the iOS app is BBIN's too, published under a game-studio entity. The older listing having disappeared while the "safe version" replaced it is consistent with an app that gets removed and re-published rather than one that sits in a store on its merits. That it is not on Google Play is the single loudest signal here — sideloading is how Android malware is delivered, because it skips store review entirely.

4 · Threat model: who is actually harmed

Three distinct groups, with different exposure:

• Gambling users (the intended market). The browser is pushed from casino sites to players who need to reach them. The operator then sits between the player and the world with a keylogger-capable client, contact and account access, and the ability to install more. The research conclusion is blunt: in criminal hands it identifies wealthy players and gets access to their machine.
• Anyone who installs it to "unblock" something. You trade a block you can see for a middleman you cannot. Logins you type, pages you load, and the destinations you visit are all visible to the exit node — an exit node in mainland China, selected by DNS records the operator controls.
• Bystanders. Contact and account permissions mean the harm does not stop at the installer.

5 · The archived page

A byte-faithful archive of the live landing page, captured 19 October 2026, running in a phone frame. It is the real page — same HTML, CSS, images and JavaScript — with three deliberate changes, because a live malicious-adjacent page should not be republished with its wires attached:

1. All outbound network is blocked (guard.js): cross-origin requests, WebSockets and beacons fail. Verified: zero external requests on load.
2. The download flow is disabled. The QR code and download button explain that this is an archive instead of producing a payload path. No APK or EXE is hosted here.
3. The two Google Analytics beacons were removed so the archive does not report to the operator's analytics property from this site.

Try the buttons — the archive refuses, and the bar at the bottom of the frame marks it as a stored copy. The download gate page (download.html) is archived too, including its fake canvas CAPTCHA, but its payload lookup is blocked.

6 · If you already installed it

1. Android: Settings → Apps → Universe Browser → Uninstall. Then run a Play Protect scan and change passwords for anything you signed into inside that browser, starting with email and banking. Revoke any account access you granted it.
2. Windows: uninstall "Universe Browser"/"UB Launcher" from Apps & Features, then run a full scan with Microsoft Defender or Malwarebytes. Because the launcher is UPX-packed and installs further components, a clean scan is not proof — if it ran on a machine that holds accounts you care about, treat the machine as potentially compromised.
3. iOS: delete the app; it has far less reach than the other builds but still sits between you and every site you visited.
4. Then: if you used it to reach anything sensitive, change those credentials from a different, clean device.

7 · What to use instead

• Privacy without a middleman: Firefox with Strict Tracking Protection, Brave, or Tor Browser.
• If you genuinely need to reach a blocked site: a reputable paid VPN with a published no-logs audit — Mullvad, ProtonVPN, IVPN. Not a "VPN browser" from a casino-adjacent vendor, and not a free APK.
• Rule of thumb: if a browser is distributed by sideloaded APK from a gambling site, no amount of "military-grade privacy" copy on the landing page changes what it is.

8 · Method, hashes and limits

What I did: fetched the site and its assets with a desktop Chrome user-agent; read the shipped JavaScript (including the download gate); resolved DNS and WHOIS; fetched the APK and the Windows launcher over HTTPS and analysed them statically only — file type, hashes, PE metadata, the compiled manifest, the signing certificate and embedded strings. Nothing was executed, installed, or run in a sandbox with network access.