CORROBORATEDDeveloper documentation describes carrier/country-filtered zero-rated SNI hosts, custom payloads and freenet VPN files, and acknowledges host volatility.Not recorded
Contradictions / Caveats
UNKNOWN: Peer-reviewed research documents zero-rating free-riding using HTTP injection/tunneling and HTTP Injector, including a controlled dataset of fraudulent and legitimate traffic.
Evidence boundary: Any specific carrier is currently vulnerable; universal free Internet; present Jordan applicability.
UNKNOWN: Official product documentation identifies HTTP Injector as a multi-protocol VPN/tunneling client supporting SSH, proxy, SSL/TLS, DNS tunnel, Shadowsocks and V2Ray with configuration import.
Evidence boundary: Free data or billing bypass on any carrier.
UNKNOWN: Current Google Play listing advertises SNI Bug Host Generation and Free Access Tools, confirming a real Android FreeNet-oriented app ecosystem.
Evidence boundary: That any advertised host currently bypasses billing or is unlimited.
Evidence boundary: Independent proof of current operational efficacy, unlimited access or billing outcome.
UNKNOWN: Official app-store description states SSH 2.0 use and customization of initial connection/injection text and SNI with configuration import/export.
Evidence boundary: Free billing or a currently exploitable carrier configuration.
UNKNOWN: FTC guidance explains that VPNs shift trust from the access network/ISP to the VPN provider and that some apps may share data or route traffic through third parties.
Evidence boundary: That every tunnel endpoint or FreeNet application is malicious.
UNKNOWN: Google security guidance treats Internet-sideloaded apps as a higher-risk channel and describes Play Protect scanning/blocking for potentially harmful apps.
Evidence boundary: That a named official tunneling app is malware.
UNKNOWN: Carrier terms permit temporary or permanent suspension when service is used or attempted to be used fraudulently.
Evidence boundary: Enforcement prevalence, thresholds or automatic suspension for a specific zero-rating case.
UNKNOWN: Official Android API documentation supports hidden SSID configuration while separately requiring WPA2/WPA3 passphrases/security parameters for protected networks.
Evidence boundary: Any method for bypassing protected Wi-Fi authentication.
Open Follow-up
OPEN [HIGH]: JORDAN_MENA_CARRIER_APPLICABILITY — No authorized carrier telemetry establishes which, if any, Jordan/MENA zero-rating configurations are currently susceptible.
OPEN [HIGH]: VENDOR_OPERATIONAL_VALIDATION — KOFnet/vendor claims about specific active hosts/configurations were not independently validated against carrier billing records.
OPEN [MEDIUM]: CONFIG_ECOSYSTEM_VALIDITY — No statistically valid measurement establishes what fraction of Telegram/YouTube FreeNet files are current, stale, fake or malicious.
OPEN [MEDIUM]: ABUSE_ENFORCEMENT_DENOMINATOR — No public denominator was recovered for carrier suspensions or enforcement events caused specifically by zero-rating free-riding.