We dont know what it does, but tests show so far, the plugin works without any internet connection for very long, people have tested and put the computer clock on 2099 and the plugin still works, all this offline. One of the ip is unkno wn and is not in the legit dll, when you run N3. It is important to be careful and block the following IPs, here is a list:

It looks like it was cracked to be sold in a chinese online store. It is known a bit about the origin of the release as wrote: So far no team has claimed this release, the original 'cracker' is unknown. (This could be done, because the original Reverser wanted to hide the changes in the plugin-dll and to prevent others from update it to newer versions.) We still dont know! The test which were done by different people here and other places show so far nothing suspicious. At the moment we have no proof that the release (windows) is safe, means it could be there is some malware code hidden, which we cant see with virustotal, since the binary is obfuscated by Themida/Code Virtualizer and thats why also this regkey is needed.

The release is not safe in terms of having all ip adresses anf things patched, it does connect to some unknown amazon server, which is not the case for the legit Nexus3 Plugin.

Refx nexus 3 torrent