_____                    _____ 
|_   _|                  /  ___|
  | | ___  __ _ _ __ ___ \ `--. 
  | |/ _ \/ _` | '_ ` _ \ `--. \
  | |  __/ (_| | | | | | /\__/ /
  \_/\___|\__,_|_| |_| |_\____/ 

-----

During an attack on AirVPN, I noticed something odd. They claim to have 'dedicated servers', yet when one takes down ONE Hong Kong/Latvia server, all goes down. This can indicate that AirVPN is use virtual servers, and a DDoS kills a whole node. I took down their Australian server (lasted 2 days), they said on a forum post that their host's DC died from it. Obviously, they probably mean virtual server's node. Their Ukraine server is very weak, it maxed out at 80mbps (claims 1gbps), died and is still down days after the attack.

Virtual Server Proof (look at latvia):
http://archive.is/CIwtN
http://www.ultraimg.com/image/poWR
https://uploadit.us/i/Eofq
http://imgur.com/rdIESEX
http://i.imgsafe.org/10931d0e87.png

AirVPN also has statistics such as user speed, bandwidth, and the server they are using. Public. They can also tell how many users are on a server. See the flaw? They log. If you can see the amount of users on a server, and see a user's bandwidth, you can probably see the IP. It sounds very much like OpenVPN's status.log.

https://airvpn.org/topusers/
http://web.archive.org/web/20161125082218/https://airvpn.org/topusers/

Even better, they say, 

"Data collected from current sessions in real-time, that we inevitably known. No history is kept, no data-retention is performed.
By default users nicknames are obscured, optionally the account holder can force them to be displayed."

This is bullshit.

Please, do not use AirVPN, they are a scam.