Is PiratBit - доступ из RUS safe?

Low risk

PiratBit - доступ из RUS routes all PiratBit domain traffic through a hardcoded third-party HTTPS proxy at xuyvamebanyerkn.woman-beauty.top.

When enabled, the extension installs a PAC-script proxy rule that redirects every request to pb.wtf, piratbit.org, piratbit.top, piratbit.fun, pirat.one, and moybit.org through a fixed HTTPS proxy server (xuyvamebanyerkn.woman-beauty.top:443). Because the proxy uses CONNECT tunneling for HTTPS targets, the proxy operator can observe all matching requests and, if SSL inspection is in use, inspect encrypted content. The remote-config endpoint (rtk.rmcontrol.net) that would have allowed dynamic server selection is present in the code but commented out; the live version uses only the hardcoded host.

PiratBitv3.4Chrome Web Store
20Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-319
SourceAI SANDBOX

All PiratBit traffic routed through an unrelated third-party proxy host

This extension gives Russian users access to PiratBit.

On load it reroutes Chrome's proxy so PiratBit-domain requests tunnel through a hardcoded server, xuyvamebanyerkn.woman-beauty.top:443, unrelated to PiratBit.

Other sites are untouched.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You install the extension to reach PiratBit from Russia.

No sign-in or setup step is required; the proxy feature is on by default.

The extension did this

It rewrites Chrome's system proxy so your PiratBit traffic flows through a third-party server.

A proxy auto-config script sends pb.wtf, piratbit.org, pirat.one, moybit.org, piratbit.top, piratbit.fun and their subdomains to xuyvamebanyerkn.woman-beauty.top:443, and everything else direct.

02EvidenceCODE COMPARE
The code that does this

The hardcoded proxy host and the PAC it generates

What it actually does
PAC builder returns the proxy for matching hosts, DIRECT otherwise (background.js:62-81)extracted/background.js
function createPac(server, proxy_hosts) {
    var host_matches = proxy_hosts.map(function(host) {
        return "shExpMatch(host, '" + host + "')";
    }).join(' || ');
    var protocol = ('http' === server.protocol) ? 'PROXY' : server.protocol.toUpperCase();
    var proxy = protocol + ' ' + server.host + ':' + parseInt(server.port, 10);
    return "function FindProxyForURL(url, host) {" +
        "if ( " + host_matches + " ) {" +
        "return '" + proxy + "';" +
        "}" +
        "return 'DIRECT';" +
        "}";
}
Applied to the whole browser at regular scope (background.js:92-101)extracted/background.js
function applyProxy(server, proxyHosts) {
    var config = {
        mode: "pac_script",
        pacScript: { data: createPac(server, proxyHosts) }
    };
    chrome.proxy.settings.set({value: config, scope: 'regular'}, function() {
        // cache cleared + active PiratBit tab reloaded
    });
}
03EvidenceOPAQUE REVEAL
Why you can't catch this in DevTools

The effect of the code above is the live PAC script Chrome runs for every navigation. Read back from chrome.proxy.settings.get during dynamic analysis, it resolves PiratBit hosts to the third-party proxy and everything else to DIRECT.

What's actually being sent
function FindProxyForURL(url, host) { if ( shExpMatch(host, 'pb.wtf') || shExpMatch(host, '*.pb.wtf') || shExpMatch(host, 'piratbit.org') || shExpMatch(host, '*.piratbit.org') || shExpMatch(host, 'pirat.one') || shExpMatch(host, '*.pirat.one') || shExpMatch(host, 'moybit.org') || shExpMatch(host, 'piratbit.top') || shExpMatch(host, '*.piratbit.top') || shExpMatch(host, 'piratbit.fun') || shExpMatch(host, '*.piratbit.fun') ) { return 'HTTPS xuyvamebanyerkn.woman-beauty.top:443'; } return 'DIRECT'; }
04EvidenceTHIRD PARTY LIST
Who sits in the network path
  • xuyvamebanyerkn.woman-beauty.top

    Hardcoded HTTPS proxy (port 443) relaying traffic to the PiratBit domains. The hostname is unrelated to PiratBit branding, so its operator has visibility over proxied connections.

  • rtk.rmcontrol.net

    Remote-config endpoint in host_permissions, present in commented-out code but unused here. A future update could use it to supply a replacement proxy host without new permissions.

05EvidenceFIELD TABLE
What the proxy operator can observe for proxied connections
FieldValueWhy it matters
The PiratBit URLs you open
https://pb.wtf/torrent/1543210Every page and asset you request on the PiratBit domains passes through the proxy, so the operator sees which torrents and pages you browse.
Cookies sent to PiratBit
Cookie: pbsid=8f2a...; uid=44213Your browser attaches its PiratBit session cookies to these requests, which travel through the proxy host.
Your PiratBit browsing pattern
GET https://piratbit.org/ at 2026-06-15T13:07:42ZThe timing and sequence of your requests to these sites are visible to whoever runs the relay.
06EvidenceNETWORK CAPTURE
Captured request
GEThttps://pb.wtf/
During dynamic analysis, with the proxy applied automatically and no activation step, pb.wtf and piratbit.org loaded their full content (38 page/asset requests) through the proxy, confirming the routing is live rather than dormant code.

Data recipients

xuyvamebanyerkn.woman-beauty.top
Updated 17 September 2026nehikipidcphpocdgbklikfgdnmakpdn