What is Tunnelblick uploading here? (> 280MB in a few sec.)

[derz...@gmail.com]

My computer was in standby mode. I turned it back on. As usual, the vpn-tunnel via tunnelblick was disconnected and started to reconnect. During this process my network monitor showed me: 

https://ibin.co/2lEkRUh0rXSp.png

200MB upload in ~20sec. 

What was happening there? Any ideas?

There was no other app using this much traffic at this time. I usually know my connections.

[jkbull...gmail.com]

It was not Tunnelblick downloading from ibin.co unless you have some kind of modified version of Tunnelblick.

It could have been that whatever told you Tunnelblick was downloading was misinterpreting a download going through an OpenVPN process that was spawned by Tunnelblick as being done by Tunnelblick.

Tunnelblick itself downloads only from tunnelblick.net. It downloads for two purposes:

• To check for updates (and if an update is available, obtain information about the update, and if you are automatically downloading updates, it will download an update, which is typically about 10MB.
  
  
• To check if the IP address changed after a VPN was connected. This download is less than 100 bytes, once before and once after a connection is made.
  

Each of these may be individually disabled via a checkbox, and on the "Preferences" panel, a checkbox can disable all Tunnelblick network activity.

The downloads are done via https:, and the update download responses (from tunnelblick.net) are all also digitally signed. The IP check is normally done via https:, but the check after a connection falls back to http: to an IP address (not a name) if the "tunnelblick.net" domain does not respond (for example, if DNS is not working).

For more details, see Privacy and Security.