Is AliBill – AliExpress Invoice Generator safe?
AliBill sends AliExpress order details to api.alibill.net and mirrors product/store clicks to an affiliate endpoint.
When used on AliExpress, AliBill posts scraped order IDs and order dates to api.alibill.net for translation before saving them locally. It also intercepts daily product or store clicks on AliExpress pages and opens a hidden request to eshopwell.xyz with the clicked URL path and the extension's stored unique ID.
Who publishes itkiril.abdulov - 1 other listing from the same operator, 1 of them carrying a finding
kiril.abdulov - 1 other listing from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 1k+ users between them. 1 of them carries a finding.
Shared hosts - 3 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
AliExpress clicks sent to cleartext affiliate URL
Clicking AliExpress product or store links makes AliBill send the clicked path to a cleartext affiliate endpoint at eshopwell.xyz/cpa, plus the extension's persistent unique_id from local storage, tying repeated clicks to the same install.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-319
- Source
- Dynamic sandbox
You click an AliExpress product or store link.
The handler applies on aliexpress.com, aliexpress.ru, and aliexpress.us pages loaded by the content script.
The extension opens a cleartext affiliate URL containing the clicked path and its persistent install identifier.
It does this through an inactive background-created tab, not through a visible extension settings screen.
- Affiliate campaign coder00525
Identifies the affiliate campaign attached to the click.
- Clicked AliExpress pathhttps://www.aliexpress.com/item/1005001234567890.html (illustrative)
Shows which AliExpress product or store link you selected.
- Persistent install identifier1k9x8w7v6u5t4s3r2q1p0o9n8m (illustrative)
Lets repeated affiliate requests be tied back to the same extension installation.
- Daily click marker15 July 2026-r00525
Limits the redirect behavior to the first matching AliExpress click for that day on the same browser profile.
Request is opened as an inactive tab; no request body is used for this GET.
The content script captures matching clicks; the background worker opens the affiliate URL
Readable click-capture logic
contentScript.jsconst dailyMarkerKey = "tt2775";const actionType = un.ACTION;function normalizeAliExpressUrl(href, currentLocation = location) { if (href.startsWith("//")) { href = currentLocation.protocol + href; } else if (href.startsWith("/")) { href = currentLocation.protocol + "//" + currentLocation.host + href; } return href.split("?")[0];}(function installAliExpressClickHandler() { try { const now = new Date(); const marker = btoa(`${now.getDate()} ${["January", "February", "March", "April", "May", "June", "July", "August", "September", "October", "November", "December"][now.getMonth()]} ${now.getFullYear()}-r00525`); chrome.storage.local.get(dailyMarkerKey, (stored) => { if (stored?.[dailyMarkerKey] === marker) { return; } const onClick = (event) => { try { const target = event.target; const anchor = target?.closest?.("a[href]"); if (!anchor) { return; } const href = anchor.getAttribute("href"); const isProductOrStore = href && (href.includes("/item/") || href.includes("/i/") || href.includes("/store")); if (!isProductOrStore) { return; } event.preventDefault(); event.stopPropagation(); document.removeEventListener("click", onClick, true); chrome.runtime.sendMessage({ messageType: actionType, url: normalizeAliExpressUrl(href) }); chrome.storage.local.set({ [dailyMarkerKey]: marker }); } catch (error) { ia(error); } }; document.addEventListener("click", onClick, true); }); } catch (error) { ia(error); }})();Readable ACTION handler
background.jsif (message?.messageType === p.ACTION) { ur(void 0, void 0, void 0, function* handleAliExpressAffiliateClick() { try { const stored = yield Z(m); const installId = stored?.[m] ?? ""; const clickedUrl = message?.url ? message.url : "https://aliexpress.com"; const params = new URLSearchParams({ subid: "r00525", url: clickedUrl }); if (installId) { params.set("subid1", installId); } chrome.tabs.create({ active: false, index: sender?.tab?.index ? sender.tab.index + 1 : 1, url: `http://eshopwell.xyz/cpa?${params.toString()}` }); } catch (error) { V(error); } });}- eshopwell.xyz
Receives the affiliate GET request containing subid=r00525, the clicked AliExpress URL path, and the extension install identifier when present.
Where it sends data
Destinations our analysis observed alibill-%E2%80%93-aliexpress-invo contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- eshopwell.xyz
alibill-%E2%80%93-aliexpress-invo sends data to eshopwell.xyz. 2 other extensions we have analysed send data here.
- api.alibill.net
alibill-%E2%80%93-aliexpress-invo sends data to api.alibill.net. No other extension we have analysed sends data here.