Is PiratBit - доступ из RUS safe?
PiratBit - доступ из RUS routes all PiratBit domain traffic through a hardcoded third-party HTTPS proxy at xuyvamebanyerkn.woman-beauty.top.
When enabled, the extension installs a PAC-script proxy rule that redirects every request to pb.wtf, piratbit.org, piratbit.top, piratbit.fun, pirat.one, and moybit.org through a fixed HTTPS proxy server (xuyvamebanyerkn.woman-beauty.top:443). Because the proxy uses CONNECT tunneling for HTTPS targets, the proxy operator can observe all matching requests and, if SSL inspection is in use, inspect encrypted content. The remote-config endpoint (rtk.rmcontrol.net) that would have allowed dynamic server selection is present in the code but commented out; the live version uses only the hardcoded host.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
All PiratBit traffic routed through an unrelated third-party proxy host
This extension gives Russian users access to PiratBit.
On load it reroutes Chrome's proxy so PiratBit-domain requests tunnel through a hardcoded server, xuyvamebanyerkn.woman-beauty.top:443, unrelated to PiratBit.
Other sites are untouched.
You install the extension to reach PiratBit from Russia.
No sign-in or setup step is required; the proxy feature is on by default.
It rewrites Chrome's system proxy so your PiratBit traffic flows through a third-party server.
A proxy auto-config script sends pb.wtf, piratbit.org, pirat.one, moybit.org, piratbit.top, piratbit.fun and their subdomains to xuyvamebanyerkn.woman-beauty.top:443, and everything else direct.
The hardcoded proxy host and the PAC it generates
function createPac(server, proxy_hosts) {
var host_matches = proxy_hosts.map(function(host) {
return "shExpMatch(host, '" + host + "')";
}).join(' || ');
var protocol = ('http' === server.protocol) ? 'PROXY' : server.protocol.toUpperCase();
var proxy = protocol + ' ' + server.host + ':' + parseInt(server.port, 10);
return "function FindProxyForURL(url, host) {" +
"if ( " + host_matches + " ) {" +
"return '" + proxy + "';" +
"}" +
"return 'DIRECT';" +
"}";
}function applyProxy(server, proxyHosts) {
var config = {
mode: "pac_script",
pacScript: { data: createPac(server, proxyHosts) }
};
chrome.proxy.settings.set({value: config, scope: 'regular'}, function() {
// cache cleared + active PiratBit tab reloaded
});
}The effect of the code above is the live PAC script Chrome runs for every navigation. Read back from chrome.proxy.settings.get during dynamic analysis, it resolves PiratBit hosts to the third-party proxy and everything else to DIRECT.
function FindProxyForURL(url, host) { if ( shExpMatch(host, 'pb.wtf') || shExpMatch(host, '*.pb.wtf') || shExpMatch(host, 'piratbit.org') || shExpMatch(host, '*.piratbit.org') || shExpMatch(host, 'pirat.one') || shExpMatch(host, '*.pirat.one') || shExpMatch(host, 'moybit.org') || shExpMatch(host, 'piratbit.top') || shExpMatch(host, '*.piratbit.top') || shExpMatch(host, 'piratbit.fun') || shExpMatch(host, '*.piratbit.fun') ) { return 'HTTPS xuyvamebanyerkn.woman-beauty.top:443'; } return 'DIRECT'; }- xuyvamebanyerkn.woman-beauty.top
Hardcoded HTTPS proxy (port 443) relaying traffic to the PiratBit domains. The hostname is unrelated to PiratBit branding, so its operator has visibility over proxied connections.
- rtk.rmcontrol.net
Remote-config endpoint in host_permissions, present in commented-out code but unused here. A future update could use it to supply a replacement proxy host without new permissions.
| Field | Value | Why it matters | |
|---|---|---|---|
The PiratBit URLs you open | https://pb.wtf/torrent/1543210 | Every page and asset you request on the PiratBit domains passes through the proxy, so the operator sees which torrents and pages you browse. | |
Cookies sent to PiratBit | Cookie: pbsid=8f2a...; uid=44213 | Your browser attaches its PiratBit session cookies to these requests, which travel through the proxy host. | |
Your PiratBit browsing pattern | GET https://piratbit.org/ at 2026-06-15T13:07:42Z | The timing and sequence of your requests to these sites are visible to whoever runs the relay. |