I'm seeing it more going the other way. Over the past few years so many services have been bought by bigger corps or even media companies. These bigger companies seem to be able to undercut the competition. Causing things like this I guess.

Though it's anyone's guess what has happened as service over time had deteriorated quite drastically.

The barrier to entry is also pretty low. It's basically a marketing game to see who can attract customers at the best rate of return. I'm guessing there are tons of VPN startups that never get large enough to keep going and the ones that do grow probably get acquired by the bigger ones.

Yeah seems to be the case. Express VPN's parent corp acquired CyberGhost, Zenmate, Private Internet access over the last few years.

They also paid as much as several of these put together for the marketing/affiliate websites Webselence, VPNmentor, Safety Detectives. Which shows how much money must be in these affiliate programs.

Sounds like a hard business for small VPN providers, getting squeezed between the cat and mouse game with content providers blocking them on one side, and users abusing the service on the other side. Same work whatever size, so better be big, or white label a big name.

What work do VPN providers do get themselves unblocked?

I'm talking about the mainstream ones like nordvpn and mulvad.

Those marketing costs need to be included in the margins - put concretely, it means cost of customer acquisition is very high. If you're spending two dollars to bring in one dollar, you're going to fail.

Consolidation is an attempt to bring those costs down by reducing the number of players bidding for customers.

Windscribe co-founder here.

Consumer VPN industry is a shit show, especially in the last 3-5 years. The parasitic "VPN review" industry is making all the money, as the "big VPNs" are paying ridiculously high CPA rates (think gambling CPA rates of $50-$100). Most "review" sites rank VPNs based on a single metric - who pays the most. This is why vpnmentor (a review site) was acquired for more money than PrivateInternetAccess (a "major VPN). Hilariously, by the same company, Kape technologies which used used to make adware (as Crossrider), and then decided to go all in on "privacy".

Then there are influencers and Youtubers, all of them peddling VPNs of the highest bidder, reading off a script and making impossible / bullshit claims about capabilities of VPNs. This outright causes harm to the industry.

VPNs that don't participate in these BS schemes (or can't pay $100/signup, and wait for ROI 3 years later), have only 1 way to grow: word of mouth, based on the merits of the product. This is very difficult to do given the massive ad spend of the "big VPNs", and false advertising they engage in.

Don't even get me started on the consolidation.... https://blog.windscribe.com/consolidation-of-the-vpn-industr...

This reminds me of Web hosting and the review industry around it 20 years back and I worked for a large web hosting provider.

The founder was really open about it. And back then hosting had ~$100 CPA and we had instances where we wouldn't turn a profit on a customer who purchased a shared hosting account UNLESS they renewed after 2 years given the cost to acquire.

To this day, when I see lists reviewing services providers, I'm always skeptical of them and steer away from letting them influence my decision on a service provider.

100% agreed with this comment.

We kind of got lumped into the VPN segment back in the day, despite being a hardware product. The cutthroat nature of the existing media agreements (NordVPN and Express VPN mainly) along with the sky high CPMs they were paying made it impossible for us to acquire customers and keep them long enough to pay our bills.

Pretty smart tactic... if you're them. Quite bad for the consumer though.

Wow. Even though you are self-interested, or maybe because of it, I hope this honesty and naked emporer approach serves you well. I have no use (?) for a VPN but I just bought the pro plan with "cool badge" sticker anyway because I like the cut of your jib.

What say you about Mullvad?

Thanks for the support, glad you enjoyed the COOL BADGE. Windscribe is full of Easter eggs and quirks, as we don't take ourselves too seriously when it comes to PR and coms (check out our Youtube). Perhaps to our detriment in some cases...

As for Mullvad, I think it's a solid service. If one needs a VPN, and doesn't want to use Windscribe for whatever reason, I always recommend IVPN or Mullvad. Windscribe is spiritually based on IVPN (I used it for many years before WS existed). No advertising, no affiliate program, no BS claims.

At the end of the day, it tunnels your friggen packets to a remote endpoint, nothing more. That alone has virtually zero impact on privacy (safe a few exceptions, like Linux ISO torrenting). The additional/optional bells and whistles we have DO make it more of a privacy suite, but that's only one small part of the big picture.

It's a pity you guys aren't hiring. I'm rather a fan of the no-bull discourse you're putting out.

I'll be swapping from ExpressVPN shortly.

We actually are if you're a network engineer or SRE. Even if you're not, we have room on pretty much every team (backend, web, QA) for like-minded individuals with a particular skill set. Feel free to drop me a line at [email protected]

Woah! thanks for your reply! Exactly the type of insight I was looking for when I wrote my comment :). Does the very high CPA indicate that the core vpn service by itself is fairly inexpensive to run, meaning that a vast majority of the costs are related to marketing and customer acquisition? Was it a "better" business to run a few years ago when competition was less cutthroat?

It's certainly a lot more competitive now. There is very little customer loyalty in the industry, especially for the average joe. "Why would I pay $x/month when I can get lifetime account with NAME_GOES_HERE VPN". We did sell Lifetime accounts for a bit, 4+ years ago, they sold like hot cakes, but if you keep doing it, you're screwed long term.

For us, biggest cost (no surprise) is infrastructure and staff, which is split ~50/50. Our ad budget is $0, however the same is not true for the big snakeoil sellers out there. They burn CRAZY cash on ads, which is why the renewal terms in fine print (at least for Nord) would make American telcos salivate with jealousy. "Buy X years for price Y, get Z months free" - you don't get any "free" months (basically a lie), and it renews at 2.5x the price, if you read the fine print.

It's really disgusting.

I'll take a look at your product. FWIW as a casual observer of consumer VPN recently, I will tell you two companies I have used and so far liked:

Mullvad, it performs well and I feel that the ability to pay cash/crypto, the lack of subscription both are tangible signals that they are real about anonymity.

Proton, with their Secure Core features is pretty nifty and I like that they have other products that shoehorn into "getting away from being spied on" by providing mail/calendar/drive storage as an alternative to Google. Their drive product could use some work but overall I'm really happy to pay $10/mo for VPN+custom domain mail+500GB of available cold storage.

Thanks for the background on the industry.

I'm personally puzzled by Proton. Their "pedigree" is nothing to snuff at, however being a privacy oriented service and then getting consumers to tunnel all their traffic through you, use your email, cloud storage, and calendar (basically all your personal info) is an odd proposition. Same goes for Nord, who also has a password manager on top of all of this.

"We store no logs for your privacy", all whole literally storing your entire life under the umbrella of one company. Why not just stick with Google at that point? At least they're a public company and heavily regulated.

Sure if someone had a certain threat model they would want to scatter their service providers more. It does go on trust a bit that Proton is doing what they say, considering you can't "prove" they don't keep logs and that I never personally loaded a public key onto a server for them to encrypt with; they kind of hand-wave it and I assume my password is used to unlock a key that decrypts content client-side.

Proton is overrated on most aspects; Fastmail is a better alternative to Proton Mail. Dropbox better than Proton Drive. (I understand you are paranoid about it, but just mentioning it is still better technically).

and you seem to provide wireguard-configs! (which for me is the #1 criterion for a sensible VPN: provide me a hop on the road which I can use however I like it; bonus-points for Mullvads cash-top-up, it works!)

We do, but for most people we suggest to use our apps. They're open source (https://github.com/Windscribe/Desktop-App), have a LOT of neat features (split tunneling, MAC spoofing, firewall, TCP socket termination, running a local proxy server, and (as of the next update) DOH/DOT support with split horizon DNS).

You can also import your own WG and OpenVPN configs into the app, and use your own servers and benefit from all of the above mentioned features. Hell, you can even use the app without a WS account, solely for this purpose.

>VPNs that don't participate in these BS schemes (or can't pay $100/signup, and wait for ROI 3 years later), have only 1 way to grow: word of mouth, based on the merits of the product. This is very difficult to do given the massive ad spend of the "big VPNs", and false advertising they engage in.

Highly agree with this statement.

That's why from my experience of using PIA, windscribe, keepsolid, Nord and mullvad.

I keep recommending mullvad VPN to collegues, acquittances and online friend (on a down side their IP reputation sucks badly, too much of captchas)

> (on a down side their IP reputation sucks badly, too much of captchas)

I'd be surprised if this doesn't apply to ALL commercial VPNs.

There are ways to get around it. I'm confident you will see much fewer CAPTCHAs on our network, as we have mitigations in place for it.

Impossible unless you have a number of IP addresses that gets close to your total number of customers online.

As soon as a service starts seeing a dozen users from a single IP, they're gonna start throwing CAPTCHAs on them more.

A single IPv6 /32 contains 4 billion /64s. Most CAPTCHA delivery domains support IPv6.

I don't know much about VPNs but that statement is one of my red flags: when a VPN provider is vague about ip reputation migrations I assume they're buying residential proxys.

We do use those for geo-unblocking, but they're not used for anti-CAPTCHA mitigations. We own and operate special purposes ASes and IP prefixes for that.

All of this can also be (verifiably) disabled by the end user in the web control panel.

> We own and operate special purposes ASes and IP prefixes for that.

The part that seems shady to me is how you do this without being caught by the up database providers are marked as a non-residential ip.

My read of GP's reply is: they use residential proxies to get around geo-blocking, and separately have special purpose ASs to avoid captchas. They're separate solutions serving separate needs; connecting to Netflix gets you the residential IP, regular browsing would get you the other one.

> We do use those for geo-unblocking

What steps, if any, are you taking to make sure you are sourcing residential proxies ethically? Honest question.

I implemented the SOCKS5 proxy, and I hardly get any. Shifted from ProtonVPN to Mullvad; rock solid connection; great app. Totally worth the investment. ProtonVPN's app is clunky, and I am not happy with it. Besides, zero Linux support despite the premium charge. I am not affiliated with Mullvad, but this represents an excellent value for money. I still have to try Windscribe. I have heard good things about them.

Wow I had no idea those fake review sites were such a big money maker. As a technical person I would instantly discard them and look for comments from real users. Word of mouth is also how I ended up with Mullvad.

I thought this kind of thing didn't happen so much with VPNs as their target market is pretty technical and I would expect those people not to fall for 'review' or comparison site scams.

Clearly I was completely wrong. I'm sorry to hear your industry is basically being blackmailed by these scammers (I consider a site pretending to give advice or comparisons but instead offering the highest bidder a total scam)

Everything is fake on MOST (I'm talking 99%) review sites. The comments are fake/cherry picked too, to make the "best" VPN look best.

We did some tests years ago by commenting positive things on "best" VPNs, and negative ones on "not best" ones. These get published every time. Do the same in reverse, only a small fraction gets posted.

Most of these "reviews" are written by SEO blog spammers, as most review sites are owned by marketing agencies or people with marketing backgrounds.

I recognize that this isn't fair, and apologize for this, but the consumer VPN industry is so obviously full of scammers and nonsense that I wouldn't go with any of the providers at all.

I have no way of knowing with anything approaching confidence which ones are decent and which ones aren't.

It really is, no offence taken. We're trying to be the cherry on top of the turd pile, but I'm not really selling it, am I...?

Actually, you're selling it very well. Speaking frankly is the first step towards gaining trust -- even if that frank speech appears not to be flattering.

I don't know much about the industry, but I'm a bit surprised to hear about them having high margins.

I'd have thought that maintaining infrastructure would be kind of a pain. You need to have outgoing access points all over the place. I assume that they mostly just rent them, but still, that's just a bunch of egress fees. And I'm sure that their customers love to stream movies through their VPN.

I suppose the fact that I hear about VPNs mostly through commercials means that the margins must be high, or they wouldn't spend so much on acquisition. But it seems like an unpleasant business to be in, with a lot of overhead and customer handholding.

> how and why VPN offering seem to have exploded recently, and how tons of them seem to be able to afford lavish ad spend even with little VC money)

This is entirely conspiracy theory, but I suspect state sponsorship.

Looking at our access logs over the same amount of time, we'd have our domestic users doing normal things, and then oddball traffic from Russia and China (and wherever else) trying to bruteforce credentials and probe for vulnerabilities.

Then we started seeing our domestic users logging in from oddball places ("Bob doesn't live or work in ___..."), and these would turn out to be legit-- they'd be using ExpressVPN or whatever. Not ideal, but ok.

But the vulnerability scans and spray-and-prays stopped coming in from foreign countries, and started coming in from known VPN ASNs-- the same ones as our legit users coming in from the same sources. While there used to be some divide between the really scummy providers and the more-sortof-legit ones, this problem has gotten even worse as these services consolidate. Now everybody's coming in from something M247-owned and that's that.

These days, enough of our users have been enticed by the promises of the VPN industry that we can't really tell who's who anymore based on IP address, and the same thing is starting to happen with useragents and mail clients. I suspect a lot of our users are simply handing over credentials to foreign agencies running some of these apps at this point. Then said agency logs in over the VPN whenever they please and we don't even notice because they're coming in from the same location as the user themselves-- there's just no such thing as "normal" anymore.

We can't ban the VPNs because inevitably some exec who thinks VPN will prevent his spouse from discovering his Grindr account will complain that he can't connect anymore, so it all gets enabled again.

Again, conspiracy theory, but if I were a state agency, normalizing abnormal behavior is what I'd do.