What is inside Honeygain.com, read out of the app itself

We build a competing earning app, so judge our bias accordingly. That is why this page sticks to what you can check yourself. Every claim below rests on a file size, a hash, a function name, a hostname or a quote.

The Honeygain.com Windows app is a .NET window wrapped around a native engine. The engine, hgwin.dll, is C++, and it opens connections from your IP address on command.

We opened the installer on our own server on 19 September 2026, and read it again on 22 September. We didn't run it, and we've never held a Honeygain account. So nothing below reports what the app earned or moved; it describes what it's built to do.

What we did with the Honeygain installer, and what we didn't do

We downloaded the installer onto a server we own, since rival software never touches a personal machine. The installer was unpacked with 7-Zip and cabextract, then read with strings. objdump gave us the export and import tables, and openssl gave us the certificate. We resolved the hostnames we found with dig and looked them up with whois.

Nothing was executed: no account was made, the client never started, and we never joined the network. A TLS handshake to read two certificates is the only thing we sent anywhere.

This is the file we read, so you can check you have the same one:

We checked the same URL again on 22 and 24 September 2026, and it still served exactly 25,281,352 bytes. That file was last modified on 20 February 2026, so this is the build they were handing out.

That signature is worth a moment, because DigiCert had to verify the legal company before issuing it. The name, the city and the company number come from the file, not from the website.

What the Honeygain installer puts on your PC

The installer's file table lists 49 files, and most of them are plumbing. These are the ones that matter, and what each of them is for:

Alongside those sit three reporting libraries: Countly for analytics, Sentry for crashes, GrowthBook for feature flags. That last one matters: parts of the app can be switched from their server, with no new version.

There is also a sign-in layer, with a Facebook library and three Google ones.

Which Honeygain file actually moves the traffic

All of the network work happens in hgwin.dll, and nowhere else. It is 7 MB of native C++, and it exports 25 functions. Their names say plainly what it is: start_proxy, stop_proxy, set_proxy_mode, get_proxy_state, and twenty-one more.

Honeygain.Proxies.dll is only 10 KB, and all it does is load the engine. It calls LoadLibrary on hgwin.dll, then reaches seven of those functions by name. It also carries a ProxyMode enum: Basic, Advanced and Legacy.

The engine is built on Boost.Asio and Boost.Beast, and it holds a WebSocket client. There is a plain one and a TLS one, plus an HTTP parser and a zlib codec. Separate resolvers handle TCP and UDP, and all of it sits in a namespace called proxy.

You don't have to take our word for it: Honeygain's own licenses page lists Boost and Msgpack-c.

The engine's message names are the clearest thing in the file. They are proxy.commands, split into incoming, outgoing and request, each with an id. That is the shape of a command channel: the far end sends instructions, and your machine answers.

The engine stops when something calls stop_proxy or quit_proxy, and there is no other way in.

Where the Honeygain app connects

Six addresses are written into hgwin.dll, in one block, and not one is honeygain.com.

All six were registered on one day, at the registrar that holds honeygain.com, inside eight seconds. Both WebSocket hosts were live when we checked again on 24 September 2026. They serve valid Google Trust Services certificates that expire on 20 November 2026.

Neither certificate carries the Honeygain name, and neither do the domains. We read ten of their public pages that day, and none of the six appeared.

In practice, if you watch your own firewall, the traffic carries no name you would recognise.

We aren't going to tell you why they're named this way, because we don't know. The bee theme is obvious, and the company's mascot is a bee. Beyond that we'd be guessing, and guessing isn't what this page is for.

Does Honeygain limit how much of your line it uses?

Not with Boost.Beast's own limiter. The library the engine is built on offers two settings for throughput. One is simple_rate_policy, the capping one. Boost describes it as limits "on the amount of bytes per second allowed for reads and writes". The other is unlimited_rate_policy, which Boost describes in one line: it "does not apply any rate limit".

We counted both in the binary: unlimited_rate_policy appears in 237 of its strings, simple_rate_policy in none. So the engine doesn't use Beast's limiter. Whether it limits throughput some other way isn't visible in the file. Honeygain's help centre has no article on limiting bandwidth either. If you need a cap, set it on your router or your operating system.

How Honeygain looks up addresses

The engine resolves names itself, over DNS-over-HTTPS, instead of asking your router. It carries a class called proxy::streams::doh, its own DNS parser, and one hard-coded resolver: https://cloudflare-dns.com/dns-query.

DNS-over-HTTPS is a published standard from 2018, RFC 8484, and it wraps each lookup in ordinary HTTPS. The standard itself is blunt about what that changes for anyone watching:

the use of the HTTPS default port 443 and the ability to mix DoH traffic with other HTTPS traffic on the same connection can deter unprivileged on-path devices from interfering with DNS operations and make DNS traffic analysis more difficult

In plain words, the names it looks up for other people won't reach your router's DNS log. They go out looking like ordinary web traffic.

What your connection is used for, in Honeygain's words

Honeygain defines its buyers in its own terms of use, under the word "Clients":

Honeygain's business clients use the traffic shared by the users to gather publicly available web data for various business purposes (e.g., pricing, brand or market analysis, ad verification, etc.).

The same document describes two ways of sharing, and the default one pays by the gigabyte. The second mode is called Content Delivery, and the terms define it like this:

Honeygain's functionality allows desktop users to share their Internet traffic through a method different from the default one. With CD, the user's device is used to reach more bandwidth-intensive content (such as images, videos, audio, streaming services, heavy websites, IPTV, etc.) upon their consent.

Two modes in the contract, three values in the binary's ProxyMode enum. The shapes match, but we couldn't work out which value is which, so we won't guess.

What can go wrong, in Honeygain's words too

This is the most useful thing on Honeygain's site, and it sits in the terms of use. Their current terms took effect on 10 August 2026 and list six consequences of sharing:

a) your internet service provider or mobile network operator may treat the sharing as a breach of its terms and may throttle, suspend or terminate your service; b) you may incur data charges if you share over a metered or mobile connection [...]; c) your IP address may be added to third-party blocklists; d) you may be shown CAPTCHA or other verification challenges more often, on any service you use from that connection; e) you may be temporarily unable to reach some websites and online services, which may include streaming, retail, banking or government services; and f) you may receive a complaint from your provider or a third party about traffic originating from your IP address.

Read (d) and (e) again, because those aren't things that happen to the buyer. They happen to you, on your own connection, while you use it for your own life.

The same terms forbid running it on a connection you don't control without permission. Not at work or school, not in a library, hotel, hospital or co-working space.

One independent test hit (c) years before it was written. In 2021 an IT consultant ran it in an isolated part of a test network and watched the firewall. That test logged over 600 distinct destinations, saw connections to mail servers, and ended up on the Spamhaus blocklist. One person, one connection, five years ago, and the method is thin. But that finding and the company's own contract now say the same thing.

What the Honeygain app reports back about you

Honeygain's privacy policy lists what the app collects about your device:

IP address, operating system version, device model, last-seen timestamp, and location (city and country).

On analytics, the same policy says the data it gathers:

may include crash and error reports, and application usage analytics provided by Google and Facebook Analytics.

The Windows build ships Countly, Sentry and GrowthBook, and the policy names none of them. The clause says "may include" rather than giving a closed list. So this is a gap in the disclosure, not a contradiction of it.

Their open source licenses page is older than the build: it dates itself "Last update: [2022-09-12]". It does have a section for the Windows application, and it lists Boost and Msgpack-c, the libraries we found in the engine.

So is Honeygain.com safe?

Two questions come up more than any others.

The first is whether it's malware, and the answer is no. It's signed by a verified company, and the security researchers most quoted on it agree. Cisco Talos calls the official client "the legitimate platform client". Its concern is trojanized installers that bundle that client with currency miners and information stealers. So download only from the vendor's own site.

The second is whether it reads your stuff, and that answer needs care. The engine does import the ordinary file and registry calls: CreateFileW, ReadFile, WriteFile, RegSetValueExA. Any program with a config file and a log does. What is missing is the spying set: no SetWindowsHookEx, no GetAsyncKeyState, no screen capture, no window-title reading. It fits their claim that the app doesn't "access personal content, track browsing activity, or collect private information". That is evidence about this build, not a promise about the next one.

The honest risk is the one in their own contract: you're lending out your address. Whatever is done with it happens under your name, on your line, to your neighbours and your bank.

What this Honeygain teardown could not check

We read the program, we didn't run it. So this page can't tell you what a real machine sent, carried, or reached. It can't tell you what travels inside that encrypted control channel, because we never opened one.

It can't tell you who owns the six domains. Every registration we could read is held by Domains By Proxy, and the certificates name only the domains. The link to Honeygain rests on one thing: the names are compiled into their own signed binary.

We only opened the Windows build, so this says nothing about Mac, Linux, Android or Docker.

And the file list comes from the installer's own table, not from a finished install. If the updater fetches something afterwards, we wouldn't have seen it.

The fast-moving parts are the installer, the addresses inside it, and the terms of use. Both certificates expire on 20 November 2026, so we'll check this page again by 20 December.

Sources

• Terms of Use, Honeygain, UAB, effective 10 August 2026
• Privacy Policy, Honeygain, UAB, read 22 September 2026
• Open Source Licenses, Honeygain, UAB, page dated 12 September 2022, read 24 September 2026
• Security, Honeygain, UAB, read 22 September 2026
• Download, Honeygain, UAB, read 22 September 2026
• Code-signing certificate for Honeygain, UAB, issued by DigiCert, Inc., read from the installer 22 September 2026
• Registry records for the six endpoint domains, Verisign via GoDaddy.com, LLC, created 3 July 2025, read 22 September 2026
• unlimited_rate_policy and simple_rate_policy, Boost.Beast reference, Boost C++ Libraries, read 22 September 2026
• RFC 8484, DNS Queries over HTTPS (DoH), IETF, October 2018
• MsQuic, Microsoft, read 22 September 2026
• Attracting flies with Honey(gain), Cisco Talos Intelligence Group, 31 August 2021
• Threat Spotlight: STRRAT, ZLoader, and HoneyGain, Cisco Umbrella, updated 28 February 2023
• Honeygain (and the risks), Life of Stu, 1 September 2021