I'm sick of ExpressVPN flooding my firewall logs
I really do not understand what ExpressVPN is doing behind the scenes when it's not open (yes, service is running in the background), why it needs to be doing it, or what the benefits are, but I'm getting close to saying screw it and going to another VPN provider.
I first noticed the issue when I had to wipe/reload one of my PCs and installed ExpressVPN fresh from a download on their site. It was vastly different than the version I had on my other PCs, even though they all were supposed to auto-update. Yes, I did launch the client occasionally even if they hadn't been used, just to get software up to date. The interface on the new install was very different, and that made me realize that my clients were not auto updating....that kind of irked me. Why have an auto-update feature if it doesn't auto-update? I'm talking several versions behind here too. The updates were not being blocked by the firewall as I have had the clients installed for a few years now and prior to getting a legit firewall in place (recent change, which is what led me down this discovery rabbit hole). That was one of the first indicators of weirdness as it was happening across multiple PCs, so it wasn't an isolated issue.
Second thing I noticed is the insane flood of outbound attempts to numerous other countries being blocked by my new firewall from these devices to random IPs. It took me a while to figure out what on earth was causing it because I would have never guessed ExpressVPN would be doing this, especially when it's not even running/connected. However, after some research, I found out it was the stupid built in maps latency/ping checker causing it. I saw another post on Reddit about this and commented there as well. They mentioned they were going to add an option to disable this, which seems to be in one of the more recent versions of the client. Why on earth was this a thing by default? An application that is not open, not connected, not doing anything, not syncing information in the background, etc. should NOT be attempting a ridiculous amount of outbound connections just for latency. I'm not talking a couple per minute here, I mean literally hundreds of requests per hour. While this is apparently "fixed" with the ability to turn it off, this was a second hit to wondering "WTF is ExpressVPN doing with their products?". Since turning this feature off on my PCs, it seems those requests have at least decreased, but not all is gone as described in my third thing noticed below.
Speed up to today, client is updated on all platforms, stupid latency map thing is turned off, client is not open but there are STILL random requests going out to other places/domains. Not at as frequent of a rate, but usually still a few requests every minute. Given the previous latency map issue, the first thing I looked at this time was ExpressVPN. I was thinking "I swear I turned that off", so I double checked my settings...yup, off on any device I see these entries for in my firewall logs. Obviously no direct correlation to ExpressVPN at that time, so I thought it was something else. Oh, but guess what? IT'S STILL EXPRESSVPN! Even though the client isn't open, the Windows service is still running in the background. Just out of curiosity, I stopped the service and waited a while before checking my firewall logs. Can you guess what happened? There were no more of these weird entries to random domains/IPs in other countries that I wasn't expecting. As soon as I started the ExpressVPN service back up, the entries come back. I have tested this off/on over the course of several hours and different days to ensure nothing else in my normal day to day is causing it, it wasn't like a 5 minute period. I have also tested this on different devices that were showing the same entries, and it's the same result across them (as well as ExpressVPN being one of the few common apps on all of them), so I know it's ExpressVPN. This is the third, and possibly final strike.
This post is in part a rant (obviously), but also to inform others of what I'm noticing in case they come across the same thing. On top of that, if any ExpressVPN employee sees this post, I'm hoping they can provide some information as to what the heck is going on over there and why they think this is OK. I have attached a screenshot of a few firewall entries to show what I'm seeing.
I'm seriously contemplating switching to another service like NordVPN or something. This behavior is unacceptable from a company that touts privacy, IMO.