Is Alibaba, AliExpress & 1688 Search by Image safe?

Medium risk

Alibaba, AliExpress & 1688 Search by Image redirects matching product pages through rzekl.com affiliate links.

When an AliExpress item or Alibaba product-detail tab updates, the extension rewrites the tab URL to a rzekl.com affiliate URL with the original product URL in the ulp parameter. The redirect is throttled per site using local storage but does not require a click on the product page.

45Risk
Who publishes it

todd - 1 other listing from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
todd

Same store account

1 other listing published from this account, 4k+ users between them. 1 of them carries a finding.

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

caverdant.online
Also called by 4 other listings, including Freelancer Helper, AlleRadar, Wistia Video Downloader
source.com
Also called by 6 other listings, including AI Content Shield - Hide AI Overviews & AI Mode | AI Content Blocker, AI Content Shield: Block AI Mode & Overviews

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Automatic Affiliate Redirect on AliExpress and Alibaba Product Pages

Opening a product page on AliExpress or Alibaba rewrites the tab to a rzekl.com URL carrying the page address, then returns you with an admitad tag attached, no click needed, once per site every 6 hours; existing affiliate parameters drop.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You open a product listing on aliexpress.com or a product-detail page on alibaba.com.

The extension did this

The background worker rewrites the tab to a rzekl.com affiliate link carrying the product URL, redirecting back to the page with the extension's own affiliate tracking attached.

No click on the product page is required; the rewrite is throttled to once per site family every 6 hours.

Captured request
GEThttps://rzekl.com/g/1e8d11449474d91068ed16525dc3e8/?subid=ssbi_a&ulp=https%3A%2F%2Fwww.aliexpress.com%2Fitem%2F1005006094306765.html

302 redirect back to the AliExpress product page, landing with admitad affiliate parameters appended (utm_source=admitad, utm_medium=cpa, utm_campaign=2369056, af=2369056, aff_platform=portals-tool).

The code that does this

Redirect logic from the shipped source (background.js) and its deobfuscated equivalent.

Readable version

Site config and the AliExpress redirect listener

const ALIEXPRESS_CFG = {  hostname: "aliexpress.com",  stringPreventingLoop: "aff_fcid",  source: "aliexpress.com/item/",  admitadBeginning: "https://rzekl.com/g/1e8d11449474d91068ed16525dc3e8/"};const ALIBABA_CFG = {  hostname: "alibaba.com",  stringPreventingLoop: "cps_sk",  source: "alibaba.com/product-detail/",  admitadBeginning: "https://rzekl.com/g/pm1aev55cl3cb142bd34219aa26f6f/"};chrome.tabs.onUpdated.addListener(async (tabId, tab) => {  if (tab.url && tab.url.includes(ALIEXPRESS_CFG.source)) {    if (tab.url.includes(ALIEXPRESS_CFG.stringPreventingLoop)) return; // already looped through us    const parsed = new URL(tab.url);    if (parsed.hostname !== ALIEXPRESS_CFG.hostname && !parsed.hostname.endsWith("." + ALIEXPRESS_CFG.hostname)) return;    const lastRedirect = await getStorage("ali") || 0;    if (lastRedirect < Date.now() - 21600000) { // 6-hour throttle      const dest = buildAffiliateUrl("aliexpress", tab.url); // origin+pathname only, query string dropped      await setStorage("ali", Date.now());      chrome.tabs.update(tabId, { url: dest });    }  }});function buildAffiliateUrl(site, originalUrl) {  const u = new URL(originalUrl);  const originPlusPath = `${u.origin}${u.pathname}`;  if (site === "aliexpress") {    const dest = new URL(ALIEXPRESS_CFG.admitadBeginning);    dest.searchParams.set("subid", "ssbi_a");    dest.searchParams.set("ulp", originPlusPath);    return dest.href;  }}

Alibaba declarativeNetRequest redirect rule

// Installed on non-matching navigations; swapped for a redirect rule once// a product-detail page (without a recognized incumbent affiliate param) loads.const ALLOW_INCUMBENT_RULE = {  id: 101, priority: 2,  action: { type: "allow" },  condition: {    regexFilter: "^https://(?:www\\.)?alibaba\\.com/product-detail/.*[?&](cps_sk|xp|tp1|pid)=",    resourceTypes: ["main_frame"]  }};const REDIRECT_RULE = {  id: 102, priority: 1,  action: { type: "redirect", redirect: {    regexSubstitution: `${ALIBABA_CFG.admitadBeginning}?subid=ssbi_dnr_2_b&ulp=\\1`  }},  condition: {    // group 1 = origin+path only; any existing query string after '?' is dropped    regexFilter: "^(https://(?:www\\.)?alibaba\\.com/product-detail/[^?#]+)(?:\\?.*)?$",    resourceTypes: ["main_frame"]  }};const STRIP_REFERER_RULE = {  id: 103, priority: 1,  action: { type: "modifyHeaders", requestHeaders: [{ header: "referer", operation: "remove" }] },  condition: { urlFilter: "||offer.alibaba.com", resourceTypes: ["main_frame"] }};async function installRedirectRules() {  await chrome.declarativeNetRequest.updateDynamicRules({    removeRuleIds: [101, 102, 103],    addRules: [ALLOW_INCUMBENT_RULE, REDIRECT_RULE, STRIP_REFERER_RULE]  });}
Dynamic test: visiting product pages that already carried a different affiliate's tracking tag
  1. ~180ms

    You did

    You open an AliExpress product page whose URL already carries another affiliate's tracking parameter (e.g. aff_trace_key=...).

    The extension did

    The tab is rewritten to the rzekl.com redirect URL built from only the page's origin and path; the existing tracking parameter is not carried over.

  2. next matching page load

    You did

    You open an Alibaba product-detail page whose URL already carries another affiliate's tracking parameter (e.g. subid=...) that is not one of the four recognized values (cps_sk, xp, tp1, pid).

    The extension did

    The declarativeNetRequest redirect rule matches on the page path alone and sends the tab through rzekl.com with the extension's own subid; the incumbent parameter is not preserved.

When this fires

Every 6 hours

Each site family (AliExpress, Alibaba) redirects at most once every 6 hours per install; a chrome.storage.local timestamp per family gates the next eligible rewrite.

Where the redirect leads
    • rzekl.com

    Admitad affiliate-network redirect service. Receives the product URL as the ulp parameter and returns a 302 with admitad campaign tracking (campaign 2369056) attached.

Where it sends data

Destinations our analysis observed Alibaba, AliExpress & 1688 Search by Image contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • rzekl.com

    Alibaba, AliExpress & 1688 Search by Image sends data to rzekl.com. One other extension we have analysed sends data here.

Updated 30 September 2026cndnkfinbmlobbgjgbhoiaikajocejgo