Is AliAssist: shopping assistant safe?
AliAssist is high risk. On gambling sites like 1xbet, Blaze, and Stake, the extension redirects to affiliate URLs before load. DA captured afiliapub.com click.php (1xbet) and blaze.cxclick.com/visit (Blaze). Source has 418 such patterns, undisclosed.…
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Gambling Site Visits Redirected Through Undisclosed Affiliate Links
On gambling sites like 1xbet, Blaze, and Stake, the extension redirects to affiliate URLs before load.
DA captured afiliapub.com click.php (1xbet) and blaze.cxclick.com/visit (Blaze).
Source has 418 such patterns, undisclosed.
You navigate to a gambling site such as 1xbet.com, blaze.com, or stake.com.
The extension immediately redirects your browser to an affiliate tracking URL before the destination page loads.
For 1xbet registration pages, the redirect fires on every visit (hourlyTimeframe: 0). Other rules fire once per hour.
| Field | Value | Why it matters | |
|---|---|---|---|
1xbet registration page | https://www.afiliapub.com/affiliates/scripts/click.php?a_aid=35458573&a_bid=fb9a1a54 | Any visit to a 1xbet.com registration URL is redirected immediately, on every visit. | |
Blaze.com homepage | https://blaze.cxclick.com/visit/?bta=47606&brand=blaze | Any visit to blaze.com redirects through Blaze's own affiliate network, recording your referral. | |
Stake.com country pages | https://stake.com/?c=j4DMpcnQ | Visiting stake.com language pages redirects to stake.com with a hardcoded referral code. | |
hourlyTimeframe: 0 | 0 (always redirect) | Rules marked 0 fire on every single visit, not just once per hour. |
The redirect execution loop from globalProgram.bundle.js
// For each platform in the redirect table:
platforms.forEach(platform => {
const currentUrl = window.location.href;
platform.redirects.forEach(rule => {
const storageKey = rule.redirectName
? `ali-help-${platform.name}-${rule.redirectName}`
: `ali-help-${platform.name}`;
const urlMatches = rule.hrefRegex.test(currentUrl);
const timeframeElapsed = BackendHelper.hasHoursPassed(storageKey, rule.hourlyTimeframe);
// hourlyTimeframe:0 → hasHoursPassed always returns true (fires every visit)
if (urlMatches && timeframeElapsed) {
if (rule.hourlyTimeframe === 0 && storage.getRedirect()) {
storage.removeRedirect(); // clear deadlock guard
return;
}
if (rule.hourlyTimeframe === 0 || rule.redirectsToDeadlockPage) {
if (!rule.skipDeadlockCheck) storage.setRedirect(true);
}
storage.setItem(Date.now()); // record last redirect time
location.assign(rule.affiliateUrl); // ← the redirect
}
});
});- afiliapub.com
Affiliate network for 1xbet. Receives affiliate ID a_aid=35458573 on every qualifying visit.
- blaze.cxclick.com
Blaze Casino's affiliate tracking network. Receives partner ID bta=47606 on every visit to blaze.com.
- stake.com
Crypto casino. Receives referral code c=j4DMpcnQ embedded in the redirect URL.
- apretailer.com.br
Brazilian affiliate network used for EstrelaBet, OlympTrade, and other platforms in the same redirect table.
Pastes into DevTools on any gambling/betting site. Intercepts location.assign before it fires and logs the affiliate URL so you can confirm the redirect without actually leaving the page.
// aliassist-redirect-detector.js
// Intercepts location.assign() to reveal any affiliate redirect before it fires.
// Run in DevTools on any site where AliAssist is active.
(function() {
const origAssign = location.assign.bind(location);
Object.defineProperty(location, 'assign', {
configurable: true,
value: function(url) {
console.warn('[ALIASSIST REDIRECT DETECTED]', url);
// Remove this line to allow the redirect to proceed:
// origAssign(url);
}
});
console.log('[aliassist-redirect-detector] installed. Navigate or change URL to trigger detection.');
})();
- 1Install AliAssist.
- 2Open a gambling site (e.g. 1xbet.com/en/registration).
- 3Open DevTools console.
- 4Paste this script, press Enter.
- 5Refresh.
- 6Watch for [ALIASSIST REDIRECT DETECTED] lines showing the affiliate URL.
Trading Platform Visits Redirected Through Undisclosed Affiliate Links
On forex/binary-options sites like Binomo, Olymp Trade, and IQ Option, the extension redirects to affiliate URLs.
DA captured binomo.com/en-en?a=79ff0fdbec72, hardcoded in source.
Fires on every visit, undisclosed in the listing.
You navigate to a trading platform such as binomo.com or olymptrade.com.
The extension immediately redirects your browser to an affiliate tracking URL before the trading platform's page loads.
All rules for these platforms use hourlyTimeframe: 0, meaning the redirect fires every time you visit, with no per-hour throttle.
| Field | Value | Why it matters | |
|---|---|---|---|
Binomo trading platform | https://binomo-r3.com?a=79ff0fdbec72&t=0 | Any visit to a localized Binomo URL is redirected to binomo-r3.com with a hardcoded affiliate ID, on every visit. | |
Olymp Trade homepage | https://apretailer.com.br/click/67f3d95b2bfa813d2c0d8e14/177973/349046/subaccount | Visiting the Olymp Trade homepage or trading page redirects through apretailer.com.br on every visit. | |
Olymp Trade (es-la, pt-br) | https://apretailer.com.br/click/67f3d95b2bfa813d2c0d8e12/178147/349046/subaccount | Localized Olymp Trade URLs each have separate redirect rules, all routing to apretailer.com.br. | |
hourlyTimeframe: 0 on all rules | 0 (always redirect) | All trading platform rules fire on every visit, not just once per hour. |
Trading platform redirect rules from globalProgram.bundle.js
// Trading platform redirect rules — all with hourlyTimeframe: 0
// (fires on every qualifying visit, no throttle)
{
platformName: 'binomo',
redirects: [
{
// Matches any localized Binomo URL: binomo.com/en-en, binomo.com/pt-br, etc.
hrefRegex: /^https:\/\/binomo\.com\/[a-z]{2}-[a-z]{2}([?&].*)?$/,
affiliateUrl: 'https://binomo-r3.com?a=79ff0fdbec72&t=0',
hourlyTimeframe: 0 // fires every visit
}
]
},
{
platformName: 'olympTrade',
redirects: [
{
// Olymp Trade homepage (global)
hrefRegex: /^https:\/\/olymptrade\.com\/$/,
affiliateUrl: 'https://apretailer.com.br/click/67f3d95b2bfa813d2c0d8e14/177973/349046/subaccount',
hourlyTimeframe: 0,
skipDeadlockCheck: true
},
{
// Olymp Trade — Spanish language
hrefRegex: /^https:\/\/olymptrade\.com\/es-la$/,
affiliateUrl: 'https://apretailer.com.br/click/67f3d95b2bfa813d2c0d8e13/178146/349046/subaccount',
hourlyTimeframe: 0,
skipDeadlockCheck: true
},
{
// Olymp Trade — Portuguese (Brazil)
hrefRegex: /^https:\/\/olymptrade\.com\/pt-br$/,
affiliateUrl: 'https://apretailer.com.br/click/67f3d95b2bfa813d2c0d8e12/178147/349046/subaccount',
hourlyTimeframe: 0,
skipDeadlockCheck: true
}
// ... additional /pages/trading/ variants for each locale
]
}- binomo-r3.com
Affiliate redirect entry point for Binomo. Receives hardcoded affiliate ID a=79ff0fdbec72 and routes to binomo.com with tracking parameters.
- apretailer.com.br
Brazilian affiliate network handling Olymp Trade, OlympTrade's localized pages, and other platform redirects. Unique click IDs per locale are hardcoded in globalProgram.bundle.js.
Shopee Product URLs Transmitted to Third-Party Server on Every Visit
On Shopee pages, the extension sends the product URL to primaz-aliexpress-bot.herokuapp.com.
DA captured it in q=; the server returns an affiliate link, redirecting to best.aliexpress.com.
AliExpress/Alibaba use apyecom.com.
Undisclosed.
You open a product page on Shopee.
The extension sends your product URL to primaz-aliexpress-bot.herokuapp.com and then redirects your browser to the affiliate version of the page.
The redirect fires on your first visit to a product and every time the visit counter exceeds 3.
The URL transmission and redirect logic from navigationHelper.bundle.js and background.bundle.js
function checkForRedirection() {
const currentUrl = window.location.href.split('?')[0];
const alreadyVisited = isSameDomain(getLastProductVisited(), currentUrl);
if (alreadyVisited) return;
setLastProductVisited(currentUrl);
const visitCount = getVisitCounter(); // from localStorage
if (visitCount === 0 || visitCount > 3) {
// Send product URL to extension background and request affiliate link
chrome.runtime.sendMessage(
{ type: 'getShopeeAffiliateLink', data: { productUrl: currentUrl } },
response => {
if (response.complete && response.result !== '') {
setVisitCounter(1); // reset counter
location.assign(response.result); // redirect to affiliate URL
}
}
);
} else {
setVisitCounter(visitCount + 1);
}
}// Hardcoded third-party backend URL — no user configuration or opt-out
static _backendUrl = 'https://primaz-aliexpress-bot.herokuapp.com';
// Sends product URL to backend; response contains the affiliate redirect URL
static async getShopeeAffiliateLink(productUrl) {
return fetch(`${this._backendUrl}/shopee-help?q=${productUrl}`, {
method: 'GET',
mode: 'cors'
}).then(r => r.json());
// Response shape: { generateShortLink: { shortLink: 'https://...' } }
// background.bundle.js: response?.generateShortLink?.shortLink || ''
}- primaz-aliexpress-bot.herokuapp.com
Third-party Heroku backend receiving product URLs and returning affiliate links, for Shopee, AliExpress, Amazon, and more. Not disclosed in the listing.
- apyecom.com
Separate affiliate redirect network used for Alibaba and AliExpress product pages. Receives the full product URL as a query parameter.
- best.aliexpress.com
Final destination after redirect, with affiliate tracking parameters (aff_fcid) appended by the backend.