Is AliAssist: shopping assistant safe?

High risk

AliAssist is high risk. On gambling sites like 1xbet, Blaze, and Stake, the extension redirects to affiliate URLs before load. DA captured afiliapub.com click.php (1xbet) and blaze.cxclick.com/visit (Blaze). Source has 418 such patterns, undisclosed.…

AliAssistv0.0.0.79Chrome Web Store
75Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-506
SourceAI SANDBOX

Gambling Site Visits Redirected Through Undisclosed Affiliate Links

On gambling sites like 1xbet, Blaze, and Stake, the extension redirects to affiliate URLs before load.

DA captured afiliapub.com click.php (1xbet) and blaze.cxclick.com/visit (Blaze).

Source has 418 such patterns, undisclosed.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You navigate to a gambling site such as 1xbet.com, blaze.com, or stake.com.

The extension did this

The extension immediately redirects your browser to an affiliate tracking URL before the destination page loads.

For 1xbet registration pages, the redirect fires on every visit (hourlyTimeframe: 0). Other rules fire once per hour.

02EvidenceNETWORK CAPTURE
Captured request
GEThttps://refpa.top/L?tag=d_54793m_1644c_35458573
302 redirect to 1xbet.com with affiliate parameters embedded
03EvidenceFIELD TABLE
Redirect rules hardcoded in globalProgram.bundle.js for gambling platforms:
FieldValueWhy it matters
1xbet registration page
https://www.afiliapub.com/affiliates/scripts/click.php?a_aid=35458573&a_bid=fb9a1a54Any visit to a 1xbet.com registration URL is redirected immediately, on every visit.
Blaze.com homepage
https://blaze.cxclick.com/visit/?bta=47606&brand=blazeAny visit to blaze.com redirects through Blaze's own affiliate network, recording your referral.
Stake.com country pages
https://stake.com/?c=j4DMpcnQVisiting stake.com language pages redirects to stake.com with a hardcoded referral code.
hourlyTimeframe: 0
0 (always redirect)Rules marked 0 fire on every single visit, not just once per hour.
04EvidenceCODE COMPARE
The code that does this

The redirect execution loop from globalProgram.bundle.js

What it actually does
// For each platform in the redirect table:
platforms.forEach(platform => {
  const currentUrl = window.location.href;
  platform.redirects.forEach(rule => {
    const storageKey = rule.redirectName
      ? `ali-help-${platform.name}-${rule.redirectName}`
      : `ali-help-${platform.name}`;
    const urlMatches = rule.hrefRegex.test(currentUrl);
    const timeframeElapsed = BackendHelper.hasHoursPassed(storageKey, rule.hourlyTimeframe);
    // hourlyTimeframe:0 → hasHoursPassed always returns true (fires every visit)
    if (urlMatches && timeframeElapsed) {
      if (rule.hourlyTimeframe === 0 && storage.getRedirect()) {
        storage.removeRedirect(); // clear deadlock guard
        return;
      }
      if (rule.hourlyTimeframe === 0 || rule.redirectsToDeadlockPage) {
        if (!rule.skipDeadlockCheck) storage.setRedirect(true);
      }
      storage.setItem(Date.now()); // record last redirect time
      location.assign(rule.affiliateUrl); // ← the redirect
    }
  });
});
05EvidenceTHIRD PARTY LIST
Affiliate networks receiving referral credit when you visit gambling platforms:
  • afiliapub.com

    Affiliate network for 1xbet. Receives affiliate ID a_aid=35458573 on every qualifying visit.

  • blaze.cxclick.com

    Blaze Casino's affiliate tracking network. Receives partner ID bta=47606 on every visit to blaze.com.

  • stake.com

    Crypto casino. Receives referral code c=j4DMpcnQ embedded in the redirect URL.

  • apretailer.com.br

    Brazilian affiliate network used for EstrelaBet, OlympTrade, and other platforms in the same redirect table.

06EvidenceARTIFACT
Check if you're affected

Pastes into DevTools on any gambling/betting site. Intercepts location.assign before it fires and logs the affiliate URL so you can confirm the redirect without actually leaving the page.

RequiresChrome with Developer mode enabledAliAssist extension installed and active
aliassist-redirect-detector.js · js
// aliassist-redirect-detector.js
// Intercepts location.assign() to reveal any affiliate redirect before it fires.
// Run in DevTools on any site where AliAssist is active.
(function() {
  const origAssign = location.assign.bind(location);
  Object.defineProperty(location, 'assign', {
    configurable: true,
    value: function(url) {
      console.warn('[ALIASSIST REDIRECT DETECTED]', url);
      // Remove this line to allow the redirect to proceed:
      // origAssign(url);
    }
  });
  console.log('[aliassist-redirect-detector] installed. Navigate or change URL to trigger detection.');
})();
How to run it
  1. 1
    Install AliAssist.
  2. 2
    Open a gambling site (e.g. 1xbet.com/en/registration).
  3. 3
    Open DevTools console.
  4. 4
    Paste this script, press Enter.
  5. 5
    Refresh.
  6. 6
    Watch for [ALIASSIST REDIRECT DETECTED] lines showing the affiliate URL.
SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Trading Platform Visits Redirected Through Undisclosed Affiliate Links

On forex/binary-options sites like Binomo, Olymp Trade, and IQ Option, the extension redirects to affiliate URLs.

DA captured binomo.com/en-en?a=79ff0fdbec72, hardcoded in source.

Fires on every visit, undisclosed in the listing.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You navigate to a trading platform such as binomo.com or olymptrade.com.

The extension did this

The extension immediately redirects your browser to an affiliate tracking URL before the trading platform's page loads.

All rules for these platforms use hourlyTimeframe: 0, meaning the redirect fires every time you visit, with no per-hour throttle.

02EvidenceNETWORK CAPTURE
Captured request
GEThttps://binomo.com/en-en?a=79ff0fdbec72&t=0
62511b response body, HTTP 200 OK, Binomo trading platform with affiliate parameters a=79ff0fdbec72&t=0 embedded
03EvidenceFIELD TABLE
Trading platform redirect rules hardcoded in globalProgram.bundle.js:
FieldValueWhy it matters
Binomo trading platform
https://binomo-r3.com?a=79ff0fdbec72&t=0Any visit to a localized Binomo URL is redirected to binomo-r3.com with a hardcoded affiliate ID, on every visit.
Olymp Trade homepage
https://apretailer.com.br/click/67f3d95b2bfa813d2c0d8e14/177973/349046/subaccountVisiting the Olymp Trade homepage or trading page redirects through apretailer.com.br on every visit.
Olymp Trade (es-la, pt-br)
https://apretailer.com.br/click/67f3d95b2bfa813d2c0d8e12/178147/349046/subaccountLocalized Olymp Trade URLs each have separate redirect rules, all routing to apretailer.com.br.
hourlyTimeframe: 0 on all rules
0 (always redirect)All trading platform rules fire on every visit, not just once per hour.
04EvidenceCODE COMPARE
The code that does this

Trading platform redirect rules from globalProgram.bundle.js

What it actually does
// Trading platform redirect rules — all with hourlyTimeframe: 0
// (fires on every qualifying visit, no throttle)

{
  platformName: 'binomo',
  redirects: [
    {
      // Matches any localized Binomo URL: binomo.com/en-en, binomo.com/pt-br, etc.
      hrefRegex: /^https:\/\/binomo\.com\/[a-z]{2}-[a-z]{2}([?&].*)?$/,
      affiliateUrl: 'https://binomo-r3.com?a=79ff0fdbec72&t=0',
      hourlyTimeframe: 0  // fires every visit
    }
  ]
},
{
  platformName: 'olympTrade',
  redirects: [
    {
      // Olymp Trade homepage (global)
      hrefRegex: /^https:\/\/olymptrade\.com\/$/,
      affiliateUrl: 'https://apretailer.com.br/click/67f3d95b2bfa813d2c0d8e14/177973/349046/subaccount',
      hourlyTimeframe: 0,
      skipDeadlockCheck: true
    },
    {
      // Olymp Trade — Spanish language
      hrefRegex: /^https:\/\/olymptrade\.com\/es-la$/,
      affiliateUrl: 'https://apretailer.com.br/click/67f3d95b2bfa813d2c0d8e13/178146/349046/subaccount',
      hourlyTimeframe: 0,
      skipDeadlockCheck: true
    },
    {
      // Olymp Trade — Portuguese (Brazil)
      hrefRegex: /^https:\/\/olymptrade\.com\/pt-br$/,
      affiliateUrl: 'https://apretailer.com.br/click/67f3d95b2bfa813d2c0d8e12/178147/349046/subaccount',
      hourlyTimeframe: 0,
      skipDeadlockCheck: true
    }
    // ... additional /pages/trading/ variants for each locale
  ]
}
05EvidenceTHIRD PARTY LIST
Affiliate networks receiving referral credit when you visit trading platforms:
  • binomo-r3.com

    Affiliate redirect entry point for Binomo. Receives hardcoded affiliate ID a=79ff0fdbec72 and routes to binomo.com with tracking parameters.

  • apretailer.com.br

    Brazilian affiliate network handling Olymp Trade, OlympTrade's localized pages, and other platform redirects. Unique click IDs per locale are hardcoded in globalProgram.bundle.js.

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Shopee Product URLs Transmitted to Third-Party Server on Every Visit

On Shopee pages, the extension sends the product URL to primaz-aliexpress-bot.herokuapp.com.

DA captured it in q=; the server returns an affiliate link, redirecting to best.aliexpress.com.

AliExpress/Alibaba use apyecom.com.

Undisclosed.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You open a product page on Shopee.

The extension did this

The extension sends your product URL to primaz-aliexpress-bot.herokuapp.com and then redirects your browser to the affiliate version of the page.

The redirect fires on your first visit to a product and every time the visit counter exceeds 3.

02EvidenceNETWORK CAPTURE
Captured request
GEThttps://primaz-aliexpress-bot.herokuapp.com/ali-help-with-client?q=https://www.aliexpress.com/&client=null
JSON response containing promotion_link[0].promotion_link, the affiliate redirect URL
03EvidenceNETWORK CAPTURE
Captured request
GEThttps://best.aliexpress.com/...?aff_fcid=355601ce5a384bb6befafb4b9887cfc0-1776241298525-07152-_c3E4ioUp
200 OK, 80KB, AliExpress product page with affiliate tracking parameters appended
04EvidenceCODE COMPARE
The code that does this

The URL transmission and redirect logic from navigationHelper.bundle.js and background.bundle.js

What it actually does
Content script — visit counter and redirect trigger
function checkForRedirection() {
  const currentUrl = window.location.href.split('?')[0];
  const alreadyVisited = isSameDomain(getLastProductVisited(), currentUrl);
  if (alreadyVisited) return;

  setLastProductVisited(currentUrl);
  const visitCount = getVisitCounter(); // from localStorage

  if (visitCount === 0 || visitCount > 3) {
    // Send product URL to extension background and request affiliate link
    chrome.runtime.sendMessage(
      { type: 'getShopeeAffiliateLink', data: { productUrl: currentUrl } },
      response => {
        if (response.complete && response.result !== '') {
          setVisitCounter(1); // reset counter
          location.assign(response.result); // redirect to affiliate URL
        }
      }
    );
  } else {
    setVisitCounter(visitCount + 1);
  }
}
Background service worker — third-party backend call
// Hardcoded third-party backend URL — no user configuration or opt-out
static _backendUrl = 'https://primaz-aliexpress-bot.herokuapp.com';

// Sends product URL to backend; response contains the affiliate redirect URL
static async getShopeeAffiliateLink(productUrl) {
  return fetch(`${this._backendUrl}/shopee-help?q=${productUrl}`, {
    method: 'GET',
    mode: 'cors'
  }).then(r => r.json());
  // Response shape: { generateShortLink: { shortLink: 'https://...' } }
  // background.bundle.js: response?.generateShortLink?.shortLink || ''
}
05EvidenceTHIRD PARTY LIST
Servers that receive your product browsing URLs:
  • primaz-aliexpress-bot.herokuapp.com

    Third-party Heroku backend receiving product URLs and returning affiliate links, for Shopee, AliExpress, Amazon, and more. Not disclosed in the listing.

  • apyecom.com

    Separate affiliate redirect network used for Alibaba and AliExpress product pages. Receives the full product URL as a query parameter.

  • best.aliexpress.com

    Final destination after redirect, with affiliate tracking parameters (aff_fcid) appended by the backend.

Updated 10 September 2026amembkpfochonfalpaelodhiaangjpih