I have reviewed the code for this addon and I would urge everyone to not install this. It acts in very Malicious ways. It connects to either one of two proxy servers for tunneling. One for YouTube streaming, and one for social media sites. It gets th proxy addresses from here: https blog.ivru net /10-11/getProxyD ataBeta.php (user and password in plain text.) when it connects to that url, it sends the users persistent UUID (does not change on browser restart) and also their session id.
It might be that the creator does not have malicious intent, but what if this is created by Russian intelligence community to track dissidents?
I have not tried to connect to the proxy, but if they use a legitimate certificate, they can't decrypt the data sent to them, they could however log which sites a user visits.
Also, it has automatic updates as well. What's to say that they won't include session cookies for all of those sites in the next version?
Hosts affected by this right now:
PROXY1:
Instagram.com, fbcdn.net, chatgpt.com, fb.com, Facebook.com, ionos.com, cdninstagram.com
PROXY2:
googlevideo.com, YouTube.com, ytimg.com, ggpht.com
This is returned when I visit the url where it fetches proxy servers from.
"{"server":{"en":{"ip":"85.192. 56. 150","port":1088,"login":"login123","password":"password123"},"ru":{"ip":"83.1 36.2 35 .76","port":1088,"login":"login123","password":"password123"}},"plginfo":""
I would be careful. I maybe just connect to one of the above proxies without the extension would be safer.
