Is Alerta de ofertas e descontos safe?
Alerta de ofertas e descontos injects a hidden whos.amung.us pixel and sends shopping page titles to descontosofertas.com.br.
Its content script runs on every page. On HTTP pages it appends a zero-size whos.amung.us image, which sends the visited page as the browser referrer along with the user's IP address. On whitelisted shopping sites it derives a product keyword from the page title and requests offers from descontosofertas.com.br, and AliExpress visits are redirected once per cookie interval through an affiliate URL.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
AliExpress Visits Redirected Through an Affiliate Link
On 15 Aug 2026, DA (v1.9) showed a live AliExpress visit redirected via the extension's affiliate link, s.click.aliexpress.com/e/6UJaM7Iqz, wrapped in base64 at descontosofertas.com.br.
AliExpress set an aeu_cid cookie; undisclosed.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-506
- Source
- Dynamic sandbox
You open any page on aliexpress.com.
The extension's script runs on every website you visit, so it is already present on the page when it finishes loading.
The extension takes your tab off that page and sends it through an affiliate link, then on to a different AliExpress page.
It first writes its own cookie so the redirect will not repeat for another two hours, shows an alert box containing the raw address, and then changes the tab's location.
The redirect, as shipped in script.js
// script.js line 98 — the wrapper host, built from the page's own protocolvar url_estrutura = document.location.protocol + "//descontosofertas.com.br/";// script.js line 6 — writes a cookie on the CURRENT page's domain.// Note: lngDias is named "days" but is multiplied by 300 * 1000 ms,// so the argument 25 below yields 25 * 300s = 7500s = 2 hours 5 minutes.function GerarCookie(strCookie, strValor, lngDias) { var dtmData = new Date(); if (lngDias) { dtmData.setTime(dtmData.getTime() + (lngDias * 300 * 1000)); var strExpires = "; expires=" + dtmData.toGMTString(); } else { var strExpires = ""; } document.cookie = strCookie + "=" + strValor + strExpires + "; path=/";}// script.js line 7 — returns the cookie value, or null if it is not set.function LerCookie(strCookie) { var strNomeIgual = strCookie + "="; var arrCookies = document.cookie.split(';'); for (var i = 0; i < arrCookies.length; i++) { var strValorCookie = arrCookies[i]; while (strValorCookie.charAt(0) == ' ') { strValorCookie = strValorCookie.substring(1, strValorCookie.length); } if (strValorCookie.indexOf(strNomeIgual) == 0) { return strValorCookie.substring(strNomeIgual.length, strValorCookie.length); } } return null;}// script.js lines 537-547 — the redirect itself.if (loja_url.search('aliexpress.com') > -1) { // any aliexpress.com URL if (!LerCookie("_alertaOfertasPrecos_red_aliexpress")) { // only if the marker cookie is absent GerarCookie("_alertaOfertasPrecos_red_aliexpress", "1", 25); // set it -> next redirect in 2h05m var urld = 'http://s.click.aliexpress.com/e/6UJaM7Iqz'; // hardcoded affiliate link, code 6UJaM7Iqz if (document.location.protocol == "https:") { // The affiliate link is plain HTTP, which an HTTPS page cannot navigate // to cleanly, so it is base64-wrapped through the operator's own host: // https://descontosofertas.com.br/com/buscape/php/api/api.php?red=<base64> urld = url_estrutura + "com/buscape/php/api/api.php?red=" + btoa(urld); } alert(urld); // alert box showing the raw address window.location.href = urld; // the tab leaves the page you opened }}302 Found → http://s.click.aliexpress.com/e/6UJaM7Iqz
The destination is base64-encoded in the address bar, so the affiliate link is not readable in the URL you would see during the redirect.
http://s.click.aliexpress.com/e/6UJaM7Iqz0ms, 302
You didThe extension changes your tab's address to the descontosofertas.com.br wrapper.
The extension didThe wrapper answers with a redirect to the affiliate link.
+670ms, 301
You didYour browser follows to http://s.click.aliexpress.com/e/6UJaM7Iqz.
The extension didAliExpress's affiliate service redirects the plain-HTTP address to its secure equivalent.
+786ms, 302
You didYour browser follows to https://s.click.aliexpress.com/e/6UJaM7Iqz.
The extension didThe affiliate service redirects on to a landing page, adding the affiliate code to the address.
+882ms, 500
You didYour browser loads the AliExpress landing page carrying the affiliate code.
The extension didAliExpress sets an attribution cookie for this browser and, in our session, returned a server error page.
- Affiliate code6UJaM7Iqz
The account credited for AliExpress purchases after this redirect. Hardcoded in the extension, so the same for every user.
- Landing address you were sent tohttps://group.aliexpress.com/br.htm?aff_fcid=c7cbf13d071742b7a17644987180685c-1786812131183-09446-6UJaM7Iqz&aff_fsk=6UJaM7Iqz&aff_platform=aaf&sk=6UJaM7Iqz&aff_trace_key=c7cbf13d071742b7a17644987180685c-1786812131183-09446-6UJaM7Iqz&terminal_id=e4e90bba5f8b4d4d9b7b56cea01aaec3
The page your tab ended up on instead of the AliExpress page you opened.
- Attribution cookie AliExpress setaeu_cid=c7cbf13d071742b7a17644987180685c-1786812131183-09446-6UJaM7Iqz; Domain=.aliexpress.com; Expires=Thu, 02-Sep-2094 19:56:18 GMT; Path=/; Secure; SameSite=None
Ties this browser to the affiliate account for the next 68 years, so purchases you make later can still be credited to it.
- The extension's own marker cookie_alertaOfertasPrecos_red_aliexpress=1; expires=Sat, 15 Aug 2026 18:47:10 GMT; path=/
Written on the AliExpress page just before the redirect. While present, the redirect won't repeat; expires after 2h5m, then fires again.
- Landing-URL session IDterminal_id=e4e90bba5f8b4d4d9b7b56cea01aaec3
A per-visit identifier AliExpress uses to join the redirect to the browser session it landed in.
- descontosofertas.com.br
Operated by the extension's publisher; also queried for its deals box. Redirects the base64 param into the plain-HTTP affiliate link, keeping the destination unreadable in source.
- s.click.aliexpress.com
AliExpress's affiliate click-tracking service (Alibaba Group). Records the click against affiliate code 6UJaM7Iqz and forwards the browser onward.
- group.aliexpress.com
AliExpress landing endpoint (Alibaba Group). Received the affiliate parameters and set the long-lived attribution cookie on the .aliexpress.com domain.
What it can do
Permissions this extension asks for, as declared in version 1.9. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
http://*/*
Where it sends data
Destinations our analysis observed Alerta de ofertas e descontos contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- s.click.aliexpress.com
Alerta de ofertas e descontos sends data to s.click.aliexpress.com. 24 other extensions we have analysed send data here.
- descontosofertas.com.br
Alerta de ofertas e descontos sends data to descontosofertas.com.br. No other extension we have analysed sends data here.
- whos.amung.us
Alerta de ofertas e descontos sends data to whos.amung.us. No other extension we have analysed sends data here.