The Russian messenger Max is exhibiting unprecedented activity on users' phones. Max checks for the presence of VPN programs to bypass blocks and attempts to connect to the domains of Telegram, WhatsApp, Amazon Web Services, and Google, after which it transmits the results — connection success, latency, and other parameters — back to the Max server.
The application of the Russian state messenger Max checks whether the user's VPN connection is active on the device, The Bell reported on March 5, citing statements from technical specialists, quoting Meduza.
Users of Habr (1, 2) and ntc.party noticed while analyzing network traffic that Max accesses third-party IP address identification services. Such requests allow determining the user's external IP, network parameters, and whether they are using a VPN.
The messenger also attempts to establish connections with the domains of Telegram, WhatsApp, Amazon Web Services, and Google, after which it transmits the results — connection success, latency, and other parameters — back to the Max server.
Technical specialists suggested that the messenger collects this data to analyze the effectiveness of blocks in the RuNet and identify ways to circumvent restrictions.
The press service of Max told Habr that the messenger application does not send requests to the servers of WhatsApp and Telegram, and that it uses information about IP addresses "exclusively to ensure the proper functioning of calls." "Requests to servers, such as Apple and Google, are necessary to verify the delivery of push notifications to users," the press service added.
In Russia, various methods are actively promoting the national messenger Max, launched in March 2025. Against this backdrop, Roskomnadzor has begun to restrict the operation of other popular messengers — WhatsApp and Telegram.
Leave a comment