Is Alerta de ofertas e descontos safe?

Medium risk

Alerta de ofertas e descontos injects a hidden whos.amung.us pixel and sends shopping page titles to descontosofertas.com.br.

Its content script runs on every page. On HTTP pages it appends a zero-size whos.amung.us image, which sends the visited page as the browser referrer along with the user's IP address. On whitelisted shopping sites it derives a product keyword from the page title and requests offers from descontosofertas.com.br, and AliExpress visits are redirected once per cookie interval through an affiliate URL.

william.wmdv1.9Chrome Web Store
47Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

AliExpress Visits Redirected Through an Affiliate Link

On 15 Aug 2026, DA (v1.9) showed a live AliExpress visit redirected via the extension's affiliate link, s.click.aliexpress.com/e/6UJaM7Iqz, wrapped in base64 at descontosofertas.com.br.

AliExpress set an aeu_cid cookie; undisclosed.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You open any page on aliexpress.com.

The extension's script runs on every website you visit, so it is already present on the page when it finishes loading.

The extension did this

The extension takes your tab off that page and sends it through an affiliate link, then on to a different AliExpress page.

It first writes its own cookie so the redirect will not repeat for another two hours, shows an alert box containing the raw address, and then changes the tab's location.

The code that does this

The redirect, as shipped in script.js

Readable version
// script.js line 98 — the wrapper host, built from the page's own protocolvar url_estrutura = document.location.protocol + "//descontosofertas.com.br/";// script.js line 6 — writes a cookie on the CURRENT page's domain.// Note: lngDias is named "days" but is multiplied by 300 * 1000 ms,// so the argument 25 below yields 25 * 300s = 7500s = 2 hours 5 minutes.function GerarCookie(strCookie, strValor, lngDias) {  var dtmData = new Date();  if (lngDias) {    dtmData.setTime(dtmData.getTime() + (lngDias * 300 * 1000));    var strExpires = "; expires=" + dtmData.toGMTString();  } else {    var strExpires = "";  }  document.cookie = strCookie + "=" + strValor + strExpires + "; path=/";}// script.js line 7 — returns the cookie value, or null if it is not set.function LerCookie(strCookie) {  var strNomeIgual = strCookie + "=";  var arrCookies = document.cookie.split(';');  for (var i = 0; i < arrCookies.length; i++) {    var strValorCookie = arrCookies[i];    while (strValorCookie.charAt(0) == ' ') {      strValorCookie = strValorCookie.substring(1, strValorCookie.length);    }    if (strValorCookie.indexOf(strNomeIgual) == 0) {      return strValorCookie.substring(strNomeIgual.length, strValorCookie.length);    }  }  return null;}// script.js lines 537-547 — the redirect itself.if (loja_url.search('aliexpress.com') > -1) {                       // any aliexpress.com URL  if (!LerCookie("_alertaOfertasPrecos_red_aliexpress")) {          // only if the marker cookie is absent    GerarCookie("_alertaOfertasPrecos_red_aliexpress", "1", 25);    // set it -> next redirect in 2h05m    var urld = 'http://s.click.aliexpress.com/e/6UJaM7Iqz';         // hardcoded affiliate link, code 6UJaM7Iqz    if (document.location.protocol == "https:") {      // The affiliate link is plain HTTP, which an HTTPS page cannot navigate      // to cleanly, so it is base64-wrapped through the operator's own host:      // https://descontosofertas.com.br/com/buscape/php/api/api.php?red=<base64>      urld = url_estrutura + "com/buscape/php/api/api.php?red=" + btoa(urld);    }    alert(urld);                                                    // alert box showing the raw address    window.location.href = urld;                                    // the tab leaves the page you opened  }}
Captured request
GEThttps://descontosofertas.com.br/com/buscape/php/api/api.php?red=aHR0cDovL3MuY2xpY2suYWxpZXhwcmVzcy5jb20vZS82VUphTTdJcXo=

302 Found → http://s.click.aliexpress.com/e/6UJaM7Iqz

Why you can't catch this in DevTools

The destination is base64-encoded in the address bar, so the affiliate link is not readable in the URL you would see during the redirect.

Decoded value
http://s.click.aliexpress.com/e/6UJaM7Iqz
The full redirect chain we captured, with timings
  1. 0ms, 302

    You did

    The extension changes your tab's address to the descontosofertas.com.br wrapper.

    The extension did

    The wrapper answers with a redirect to the affiliate link.

  2. +670ms, 301

    You did

    Your browser follows to http://s.click.aliexpress.com/e/6UJaM7Iqz.

    The extension did

    AliExpress's affiliate service redirects the plain-HTTP address to its secure equivalent.

  3. +786ms, 302

    You did

    Your browser follows to https://s.click.aliexpress.com/e/6UJaM7Iqz.

    The extension did

    The affiliate service redirects on to a landing page, adding the affiliate code to the address.

  4. +882ms, 500

    You did

    Your browser loads the AliExpress landing page carrying the affiliate code.

    The extension did

    AliExpress sets an attribution cookie for this browser and, in our session, returned a server error page.

What the final AliExpress address and its response carried
  • Affiliate code
    6UJaM7Iqz

    The account credited for AliExpress purchases after this redirect. Hardcoded in the extension, so the same for every user.

  • Landing address you were sent to
    https://group.aliexpress.com/br.htm?aff_fcid=c7cbf13d071742b7a17644987180685c-1786812131183-09446-6UJaM7Iqz&aff_fsk=6UJaM7Iqz&aff_platform=aaf&sk=6UJaM7Iqz&aff_trace_key=c7cbf13d071742b7a17644987180685c-1786812131183-09446-6UJaM7Iqz&terminal_id=e4e90bba5f8b4d4d9b7b56cea01aaec3

    The page your tab ended up on instead of the AliExpress page you opened.

  • Attribution cookie AliExpress set
    aeu_cid=c7cbf13d071742b7a17644987180685c-1786812131183-09446-6UJaM7Iqz; Domain=.aliexpress.com; Expires=Thu, 02-Sep-2094 19:56:18 GMT; Path=/; Secure; SameSite=None

    Ties this browser to the affiliate account for the next 68 years, so purchases you make later can still be credited to it.

  • The extension's own marker cookie
    _alertaOfertasPrecos_red_aliexpress=1; expires=Sat, 15 Aug 2026 18:47:10 GMT; path=/

    Written on the AliExpress page just before the redirect. While present, the redirect won't repeat; expires after 2h5m, then fires again.

  • Landing-URL session ID
    terminal_id=e4e90bba5f8b4d4d9b7b56cea01aaec3

    A per-visit identifier AliExpress uses to join the redirect to the browser session it landed in.

Hosts your tab was sent through
    • descontosofertas.com.br

    Operated by the extension's publisher; also queried for its deals box. Redirects the base64 param into the plain-HTTP affiliate link, keeping the destination unreadable in source.

    • s.click.aliexpress.com

    AliExpress's affiliate click-tracking service (Alibaba Group). Records the click against affiliate code 6UJaM7Iqz and forwards the browser onward.

    • group.aliexpress.com

    AliExpress landing endpoint (Alibaba Group). Received the affiliate parameters and set the long-lived attribution cookie on the .aliexpress.com domain.

What it can do

Permissions this extension asks for, as declared in version 1.9. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    http://*/*

Where it sends data

Destinations our analysis observed Alerta de ofertas e descontos contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • s.click.aliexpress.com

    Alerta de ofertas e descontos sends data to s.click.aliexpress.com. 24 other extensions we have analysed send data here.

  • descontosofertas.com.br

    Alerta de ofertas e descontos sends data to descontosofertas.com.br. No other extension we have analysed sends data here.

  • whos.amung.us

    Alerta de ofertas e descontos sends data to whos.amung.us. No other extension we have analysed sends data here.

Updated 30 September 2026jikhbokinakhjbhoifafpbaemffhomjl