Is Alibaba, AliExpress & 1688 Search by Image safe?
Alibaba, AliExpress & 1688 Search by Image redirects matching product pages through rzekl.com affiliate links.
When an AliExpress item or Alibaba product-detail tab updates, the extension rewrites the tab URL to a rzekl.com affiliate URL with the original product URL in the ulp parameter. The redirect is throttled per site using local storage but does not require a click on the product page.
Who publishes ittodd - 1 other listing from the same operator, 1 of them carrying a finding
todd - 1 other listing from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 4k+ users between them. 1 of them carries a finding.
Shared hosts - 2 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Automatic Affiliate Redirect on AliExpress and Alibaba Product Pages
Opening a product page on AliExpress or Alibaba rewrites the tab to a rzekl.com URL carrying the page address, then returns you with an admitad tag attached, no click needed, once per site every 6 hours; existing affiliate parameters drop.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-506
- Source
- Dynamic sandbox
You open a product listing on aliexpress.com or a product-detail page on alibaba.com.
The background worker rewrites the tab to a rzekl.com affiliate link carrying the product URL, redirecting back to the page with the extension's own affiliate tracking attached.
No click on the product page is required; the rewrite is throttled to once per site family every 6 hours.
302 redirect back to the AliExpress product page, landing with admitad affiliate parameters appended (utm_source=admitad, utm_medium=cpa, utm_campaign=2369056, af=2369056, aff_platform=portals-tool).
Redirect logic from the shipped source (background.js) and its deobfuscated equivalent.
Site config and the AliExpress redirect listener
const ALIEXPRESS_CFG = { hostname: "aliexpress.com", stringPreventingLoop: "aff_fcid", source: "aliexpress.com/item/", admitadBeginning: "https://rzekl.com/g/1e8d11449474d91068ed16525dc3e8/"};const ALIBABA_CFG = { hostname: "alibaba.com", stringPreventingLoop: "cps_sk", source: "alibaba.com/product-detail/", admitadBeginning: "https://rzekl.com/g/pm1aev55cl3cb142bd34219aa26f6f/"};chrome.tabs.onUpdated.addListener(async (tabId, tab) => { if (tab.url && tab.url.includes(ALIEXPRESS_CFG.source)) { if (tab.url.includes(ALIEXPRESS_CFG.stringPreventingLoop)) return; // already looped through us const parsed = new URL(tab.url); if (parsed.hostname !== ALIEXPRESS_CFG.hostname && !parsed.hostname.endsWith("." + ALIEXPRESS_CFG.hostname)) return; const lastRedirect = await getStorage("ali") || 0; if (lastRedirect < Date.now() - 21600000) { // 6-hour throttle const dest = buildAffiliateUrl("aliexpress", tab.url); // origin+pathname only, query string dropped await setStorage("ali", Date.now()); chrome.tabs.update(tabId, { url: dest }); } }});function buildAffiliateUrl(site, originalUrl) { const u = new URL(originalUrl); const originPlusPath = `${u.origin}${u.pathname}`; if (site === "aliexpress") { const dest = new URL(ALIEXPRESS_CFG.admitadBeginning); dest.searchParams.set("subid", "ssbi_a"); dest.searchParams.set("ulp", originPlusPath); return dest.href; }}Alibaba declarativeNetRequest redirect rule
// Installed on non-matching navigations; swapped for a redirect rule once// a product-detail page (without a recognized incumbent affiliate param) loads.const ALLOW_INCUMBENT_RULE = { id: 101, priority: 2, action: { type: "allow" }, condition: { regexFilter: "^https://(?:www\\.)?alibaba\\.com/product-detail/.*[?&](cps_sk|xp|tp1|pid)=", resourceTypes: ["main_frame"] }};const REDIRECT_RULE = { id: 102, priority: 1, action: { type: "redirect", redirect: { regexSubstitution: `${ALIBABA_CFG.admitadBeginning}?subid=ssbi_dnr_2_b&ulp=\\1` }}, condition: { // group 1 = origin+path only; any existing query string after '?' is dropped regexFilter: "^(https://(?:www\\.)?alibaba\\.com/product-detail/[^?#]+)(?:\\?.*)?$", resourceTypes: ["main_frame"] }};const STRIP_REFERER_RULE = { id: 103, priority: 1, action: { type: "modifyHeaders", requestHeaders: [{ header: "referer", operation: "remove" }] }, condition: { urlFilter: "||offer.alibaba.com", resourceTypes: ["main_frame"] }};async function installRedirectRules() { await chrome.declarativeNetRequest.updateDynamicRules({ removeRuleIds: [101, 102, 103], addRules: [ALLOW_INCUMBENT_RULE, REDIRECT_RULE, STRIP_REFERER_RULE] });}~180ms
You didYou open an AliExpress product page whose URL already carries another affiliate's tracking parameter (e.g. aff_trace_key=...).
The extension didThe tab is rewritten to the rzekl.com redirect URL built from only the page's origin and path; the existing tracking parameter is not carried over.
next matching page load
You didYou open an Alibaba product-detail page whose URL already carries another affiliate's tracking parameter (e.g. subid=...) that is not one of the four recognized values (cps_sk, xp, tp1, pid).
The extension didThe declarativeNetRequest redirect rule matches on the page path alone and sends the tab through rzekl.com with the extension's own subid; the incumbent parameter is not preserved.
Every 6 hours
Each site family (AliExpress, Alibaba) redirects at most once every 6 hours per install; a chrome.storage.local timestamp per family gates the next eligible rewrite.
- rzekl.com
Admitad affiliate-network redirect service. Receives the product URL as the ulp parameter and returns a 302 with admitad campaign tracking (campaign 2369056) attached.
Where it sends data
Destinations our analysis observed Alibaba, AliExpress & 1688 Search by Image contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- rzekl.com
Alibaba, AliExpress & 1688 Search by Image sends data to rzekl.com. One other extension we have analysed sends data here.