Stealth transport
Traffic that carries no VPN signature. Survives deep packet inspection, active probing, and SNI-based blocking on hostile networks.
Umbra // Stealth Network — VLESS · XTLS-Reality
Fade into the
Digital Shadow
Umbra is a VPN engineered to be unobservable. No handshake pattern, no packet signature, no fingerprint a deep packet inspector can flag — because on the wire it isn't a VPN at all. It is TLS 1.3 to a website that genuinely exists.
- Edge Sites
- 0
- Processing Latency
- <1ms
- Logs Retained
- 0
- DPI Evasion
- Active
[ 01 ] Interference
There is nothing neutral
about the network
Between your device and the internet sits equipment whose entire purpose is to classify you. Deep packet inspection never needs to break your encryption — it only needs to recognise its shape. And the moment your VPN has a shape, it can be throttled, logged, or dropped.
01OpenVPN / TCP
opcode signature matchedBlocked
02WireGuard
fixed handshake patternThrottled
03IPsec / IKEv2
udp/500 · isakmp headerBlocked
04Shadowsocks
entropy anomaly · active probeFlagged
05Umbra
tls 1.3 · valid sni · real certNo match
Classification, not decryption
Middleboxes fingerprint the handshake, the packet cadence, and the byte-length distribution. Your payload stays encrypted and you still get identified in milliseconds.
Active probing
Censors don't only watch — they connect to your server and check whether it behaves like a proxy. A server that answers wrong is burned permanently.
The retention problem
Most providers still keep connection metadata "for troubleshooting". Metadata is the whole case. If it exists on a disk, it can be subpoenaed, seized, or leaked.
The tax you already pay
Ads and trackers consume a measurable share of every page you load — bandwidth, battery, and a permanent behavioural profile you never agreed to.
[ 02 ] Protocol
Indistinguishable
by construction
REALITY completes a genuine TLS handshake with a real, high-reputation website and borrows its certificate chain. An observer sees a legitimate connection to a legitimate host, because for the first packets that is exactly what it is. XTLS Vision then lifts the redundant second layer of encryption off the data path — so you stop paying for TLS twice, and Umbra's own processing cost stays under a millisecond.
Traffic signature analyser
- Observed protocol
- TLS 1.3 · HTTPS
- Classifier confidence
- No VPN signature found
- Middlebox action
- Pass · unmodified
Umbra stack
VLESSXTLS-RPRX-VisionREALITY
uTLS fingerprintX25519 key exchangeChaCha20-Poly1305
0-RTT resumptionNo SNI leak<1 ms processing
[ 03 ] Capability
No compromise anywhere
in the path
Sub-millisecond overhead
Conventional tunnels encrypt an already-encrypted stream, paying for TLS twice on every packet. XTLS Vision drops that second pass, so Umbra adds under a millisecond of processing latency — the only delay left is the speed of light.
Zero-log architecture
Nothing to hand over. Nodes run immutable and stateless with session state held in RAM — logging isn't switched off, there is nowhere for a log to be written.
Network-level ad & tracker kill
Ads, trackers and telemetry are dropped at the exit node, before they ever enter the tunnel. Nothing to install and nothing to configure — you save the bandwidth as well as the privacy, on every device on the account.
Self-hosted Monero
XMR settled against our own node — no processor, no billing identity, no chargeback trail that links a human being to a session.
Every device you own
iOS, Android, macOS, Windows, Linux and routers. One account, one config, identical behaviour on all of them.
[ 04 ] Network
A small, fast,
deliberate footprint
Umbra doesn't chase server counts. Nodes sit in tier-1 datacentres across Europe, North America and Asia, picked for peering quality rather than marketing math — and every one is destroyed and rebuilt from a signed image on each change.
- Sites
- 7
- Countries
- 4
- Persistent disks
- 0
Drag to rotate
[ 05 ] Architecture
Built so the logs
cannot exist
L1
InfrastructureDedicated cloud compute
Tier-1 peering
L2
Operating systemTalos Linux
No shell · No SSH
L3
OrchestrationKubernetes
Declarative · ephemeral
L4
CamouflageREALITY
Borrowed TLS identity
L5
TransportVLESS + XTLS Vision
Single-pass crypto
L6
ClientUmbra app
All platforms
Talos has no shell and no SSH daemon. There is no interactive session to open, so there is no operator — including us — who can quietly attach to a running node and start capturing. The whole cluster is declared in code, and every node's state lives in RAM.
What we store about you
Connection timestampsNull
Source IP addressesNull
DNS queriesNull
Bandwidth per accountNull
Session durationNull
Payment identity (XMR)Null
[ 06 ] Deployment
One account. Everywhere.
iOS
Android
macOS
Windows
Linux
Routers
[ 07 ] Access
One tier.
Everything included.
No feature gates, no "premium" servers, no bandwidth games. The only decision is how long you want to stay dark.
Monthly
$10
per month
- Unlimited bandwidth
- 2 simultaneous devices
- XTLS-Reality stealth mode
- Server-side ad & tracker blocking
- Zero-log policy
3 Months
$25
per quarter · $8.33 / month
Save $5 against monthly
- Unlimited bandwidth
- 2 simultaneous devices
- XTLS-Reality stealth mode
- Server-side ad & tracker blocking
- Zero-log policy
Best value
Yearly
$80
per year · $6.67 / month
Save $40 against monthly
- Everything in monthly
- Priority node allocation
- Config rollover on rebuild
- Monero or card
- Cancel any time
Monero · XMR
Card · Stripe
Monero checkout requires no email address.