Is PiratBit - доступ из RUS safe?

Low risk

PiratBit - доступ из RUS routes all PiratBit domain traffic through a hardcoded third-party HTTPS proxy at xuyvamebanyerkn.woman-beauty.top.

When enabled, the extension installs a PAC-script proxy rule that redirects every request to pb.wtf, piratbit.org, piratbit.top, piratbit.fun, pirat.one, and moybit.org through a fixed HTTPS proxy server (xuyvamebanyerkn.woman-beauty.top:443). Because the proxy uses CONNECT tunneling for HTTPS targets, the proxy operator can observe all matching requests and, if SSL inspection is in use, inspect encrypted content. The remote-config endpoint (rtk.rmcontrol.net) that would have allowed dynamic server selection is present in the code but commented out; the live version uses only the hardcoded host.

PiratBitv3.4Chrome Web Store
17Risk
Who publishes it

PiratBit - 2 other listings from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
PiratBit

Same store account

2 other listings published from this account, 11k+ users between them, none of them carrying a finding.

PiratBit10k+CleanСвободный доступ на PiratBit из RU1k+Clean

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

pb.wtf
Also called by 1 other listing: pbit_ru
rtk.rmcontrol.net
Also called by 3 other listings, including Rutracker, доступ-к-рутрекеру

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

All PiratBit traffic routed through an unrelated third-party proxy host

HighunwantedCWE-319Dynamic sandbox

This extension gives Russian users access to PiratBit.

What actually happens

You did this

You install the extension to reach PiratBit from Russia.

No sign-in or setup step is required; the proxy feature is on by default.

The extension did this

It rewrites Chrome's system proxy so your PiratBit traffic flows through a third-party server.

A proxy auto-config script sends pb.wtf, piratbit.org, pirat.one, moybit.org, piratbit.top, piratbit.fun and their subdomains to xuyvamebanyerkn.woman-beauty.top:443, and everything else direct.

The code that does this

The hardcoded proxy host and the PAC it generates

Readable version

PAC builder returns the proxy for matching hosts, DIRECT otherwise (background.js:62-81)

extracted/background.js
function createPac(server, proxy_hosts) {    var host_matches = proxy_hosts.map(function(host) {        return "shExpMatch(host, '" + host + "')";    }).join(' || ');    var protocol = ('http' === server.protocol) ? 'PROXY' : server.protocol.toUpperCase();    var proxy = protocol + ' ' + server.host + ':' + parseInt(server.port, 10);    return "function FindProxyForURL(url, host) {" +        "if ( " + host_matches + " ) {" +        "return '" + proxy + "';" +        "}" +        "return 'DIRECT';" +        "}";}

Applied to the whole browser at regular scope (background.js:92-101)

extracted/background.js
function applyProxy(server, proxyHosts) {    var config = {        mode: "pac_script",        pacScript: { data: createPac(server, proxyHosts) }    };    chrome.proxy.settings.set({value: config, scope: 'regular'}, function() {        // cache cleared + active PiratBit tab reloaded    });}

Why you can't catch this in DevTools

The effect of the code above is the live PAC script Chrome runs for every navigation. Read back from chrome.proxy.settings.get during dynamic analysis, it resolves PiratBit hosts to the third-party proxy and everything else to DIRECT.

Decoded value
function FindProxyForURL(url, host) { if ( shExpMatch(host, 'pb.wtf') || shExpMatch(host, '*.pb.wtf') || shExpMatch(host, 'piratbit.org') || shExpMatch(host, '*.piratbit.org') || shExpMatch(host, 'pirat.one') || shExpMatch(host, '*.pirat.one') || shExpMatch(host, 'moybit.org') || shExpMatch(host, 'piratbit.top') || shExpMatch(host, '*.piratbit.top') || shExpMatch(host, 'piratbit.fun') || shExpMatch(host, '*.piratbit.fun') ) { return 'HTTPS xuyvamebanyerkn.woman-beauty.top:443'; } return 'DIRECT'; }

Who sits in the network path

    • xuyvamebanyerkn.woman-beauty.top

    Hardcoded HTTPS proxy (port 443) relaying traffic to the PiratBit domains. The hostname is unrelated to PiratBit branding, so its operator has visibility over proxied connections.

    • rtk.rmcontrol.net

    Remote-config endpoint in host_permissions, present in commented-out code but unused here. A future update could use it to supply a replacement proxy host without new permissions.

What the proxy operator can observe for proxied connections

  • The PiratBit URLs you open
    https://pb.wtf/torrent/1543210

    Every page and asset you request on the PiratBit domains passes through the proxy, so the operator sees which torrents and pages you browse.

  • Cookies sent to PiratBit
    Cookie: pbsid=8f2a...; uid=44213

    Your browser attaches its PiratBit session cookies to these requests, which travel through the proxy host.

  • Your PiratBit browsing pattern
    GET https://piratbit.org/ at 2026-06-15T13:07:42Z

    The timing and sequence of your requests to these sites are visible to whoever runs the relay.

Captured request

GEThttps://pb.wtf/

During dynamic analysis, with the proxy applied automatically and no activation step, pb.wtf and piratbit.org loaded their full content (38 page/asset requests) through the proxy, confirming the routing is live rather than dormant code.

What it can do

Permissions this extension asks for, as declared in version 3.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on rtk.rmcontrol.net

    https://rtk.rmcontrol.net/

  • Read and change your data on pb.wtf

    *://pb.wtf/*

  • Read and change your data on piratbit.org

    *://piratbit.org/*

  • Read and change your data on pirat.one

    *://pirat.one/*

  • Read and change your data on moybit.org

    *://moybit.org/*

  • Read and change your data on piratbit.top

    *://piratbit.top/*

  • Read and change your data on piratbit.fun

    *://piratbit.fun/*

  • Route all of your browsing through a server of its choosing

    proxy

  • Act on the current tab, but only after you click the extension

    activeTab

  • Clear your browsing history, cache and cookies

    browsingData

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed PiratBit - доступ из RUS contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • xuyvamebanyerkn.woman-beauty.top

    PiratBit - доступ из RUS sends data to xuyvamebanyerkn.woman-beauty.top. 2 other extensions we have analyzed send data here.

Updated 30 September 2026nehikipidcphpocdgbklikfgdnmakpdn