Is alerabat.com | kupony i cashback safe?
alerabat.com is medium risk. Dynamic analysis showed clicking the alerabat.com icon sends the page's hostname to two GA endpoints, v3 (UA-35417772-32) and v4 (G-8BK7QDVC14), each with a persistent ID, letting the operator build a per-device record of visited sites.
Who publishes itAlerabat.com sp. z o.o. - no other listings under this identity
Alerabat.com sp. z o.o. - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Icon click leaks current tab hostname to Google Analytics
Dynamic analysis showed clicking the alerabat.com icon sends the page's hostname to two GA endpoints, v3 (UA-35417772-32) and v4 (G-8BK7QDVC14), each with a persistent ID, letting the operator build a per-device record of visited sites.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
You click the alerabat.com extension icon while visiting any website.
The click fires even when the site is unrelated to the extension's coupon/cashback purpose.
The extension immediately POSTs the hostname of your current tab to two Google Analytics endpoints.
Both GA v3 (UA-35417772-32) and GA v4 (G-8BK7QDVC14) requests are sent within the same debounce window (400 ms), each carrying a persistent device identifier.
Captured during dynamic analysis. client_id is a rnd_-prefixed UUID stored in extension local storage.
- Content-Type
- application/json
{ "client_id": "rnd_b83e95a0-00fe-4b7e-b4df-1d269da17e21", "events": [ { "name": "plugin_icon_click", "params": { "domain_location": "buykers.co.uk", "browser": "Chrome", "browser_version": "146", "language": "en-GB" } } ]}Captured during dynamic analysis. cid matches the GA v4 client_id (without rnd_ prefix); uid is the account user ID.
v=1&tid=UA-35417772-32&cid=b83e95a0-00fe-4b7e-b4df-1d269da17e21&uid=a376c297-8d0d-4847-ae78-95d93c8ca9c6&t=event- Current tab hostnamebuykers.co.uk
The domain name of whatever website you have open when you click the icon. Recorded in the domain_location parameter.
- Persistent client IDrnd_b83e95a0-00fe-4b7e-b4df-1d269da17e21
A UUID generated at install and stored locally. Stays constant across sessions, linking every icon click to the same device.
- Account user IDa376c297-8d0d-4847-ae78-95d93c8ca9c6
If you are logged into alerabat.com, your account UUID is also sent in the GA v3 payload, linking the event to your registered account.
- Browser + versionChrome 146
The name and version of your browser, included in the GA v4 event params.
GA v4 event payload construction, hostname extraction
// background.js ~line 53905 (GA v4 saga, CLICK_EXTENSION_ICON handler)const tabUrl = yield call(getUrlFromTab, activeTabId);let hostname;try { hostname = new URL(tabUrl).hostname; // e.g. "buykers.co.uk"} catch (e) { hostname = "";}const eventParams = { location: hostname, // → domain_location in the GA payload activeShop: activeShop, ext_cid: clientId, // persistent UUID from chrome.storage extVersion: Platform.getVersion(), browser: Platform.getPlatform(), browser_version: Platform.getBrowserVersion(), language: getLocale()};// Dispatched to Axiosv4EventSender.sendMany() →// POST /mp/collect?api_secret=<redacted>&measurement_id=G-8BK7QDVC14- www.google-analytics.com
Google Analytics. Receives GA v3 (/collect, /batch) and GA v4 (/mp/collect) events. IDs UA-35417772-32 (v3), G-8BK7QDVC14 (v4), attributed to the operator's GA property.