Is Promer: Save, Clone & Create AI Ad Creatives safe?

Medium risk

AliHunter is medium risk. A hidden 0x0 iframe on AliExpress product pages loads alitems.com with the page URL, setting affiliate cookies (aeu_cid expires 2094, Admitad UID/UID2). The background worker also sends the product ID to minion.alihunter.io.

FireGroupv4.2.0Chrome Web Store
48Risk
Who publishes it

FireGroup - no other listings under this identity, 3 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
FireGroup
Website
help.promer.ai

Shared hosts - 3 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

minion.alihunter.io
Also called by 2 other listings, including Ali Reviews
go.onecommerce.io
Also called by 3 other listings, including Ali Reviews
operate-lumen-api.socialhead.io
Also called by 3 other listings, including Ali Reviews

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Zero-Pixel Affiliate Iframe on Every AliExpress Product Page

A hidden 0x0 iframe on AliExpress product pages loads alitems.com with the page URL, setting affiliate cookies (aeu_cid expires 2094, Admitad UID/UID2).

The background worker also sends the product ID to minion.alihunter.io.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You open a product page on AliExpress.

No click, no button and no interaction with the extension is needed - it happens as the page finishes loading.

The extension did this

The extension appends a 0x0, fully transparent iframe to the bottom of the page that loads an affiliate redirector.

The iframe's address includes the web address of the product page you are currently viewing.

Captured request
GEThttps://alitems.com/g/1e8d114494bb14f679c416525dc3e8/?subid=AH&ulp=https%3A%2F%2Fwww.aliexpress.com%2Fitem%2F1005003391567749.html

302 redirect to https://s.click.aliexpress.com/deep_link.htm?aff_short_key=_ePNSNV&dl_target_url=https%3A%2F%2Fwww.aliexpress.com%2Fitem%2F1005003391567749.html%3Fdp%3D7fbdd95dc4ae95cb1d659faf0d200ae8%26af%3D604548%26cv%3D47843%26afref%3Dhttps%253A%252F%252Fwww.aliexpress.com%252F%26mall_affr%3Dpr3%26utm_source%3Dadmitad%26utm_medium%3Dcpa%26utm_campaign%3D604548%26utm_content%3D47843&dp=7fbdd95dc4ae95cb1d659faf0d200ae8&af=604548&cv=47843&afref=https%3A%2F%2Fwww.aliexpress.com%2F&mall_affr=pr3&utm_source=admitad&utm_medium=cpa&utm_campaign=604548&utm_content=47843 - the response set UID and UID2 cookies scoped to .ad.admitad.com.

What the redirect chain leaves in your browser
  • AliExpress affiliate-attribution cookie
    aeu_cid=56609a7c47684ddb8804d161d773e787-1786810805323-07428-_c3CT77eX; Domain=.aliexpress.com; Expires=Thu, 02-Sep-2094 19:34:12 GMT; Path=/; Secure; SameSite=None

    Ties any AliExpress purchase back to the extension's affiliate account. Expires in 2094, so it stays until you clear cookies.

  • Admitad advertising-network identifier
    UID=v=3|id=c225da9808fe3680e8e219a8e0a7aa82|expr=1849882804|type=0|business_expr=1787070004; Domain=.ad.admitad.com; Expires=Mon, 14 Aug 2028 16:20:04 GMT; Secure; Path=/; SameSite=None

    An ad-network ID set by the affiliate network the redirect passes through, letting it recognize your browser on other sites in its program.

  • AliExpress affiliate-session flags
    af_ss_a=1; Path=/; Domain=.aliexpress.com; Max-Age=2147483647; Secure; SameSite=None

    Marks your AliExpress session as having arrived through an affiliate link. Set with the largest lifetime a cookie can be given.

  • The product page you had open
    ulp=https%3A%2F%2Fwww.aliexpress.com%2Fitem%2F1005003391567749.html

    The address of the AliExpress page you are viewing is passed to the affiliate redirector as part of the iframe's address.

The code that does this

The injector, the identifiers, and the entry point that fires them

Readable version

The iframe injector and the affiliate URL builder

content-scripts/aliexpress.js
Qt = t => {  const e = `<iframe src="${t}" height="0" width="0" style="opacity: 0;"></iframe>`;  document.body.insertAdjacentHTML("beforeend", e)},en = () => {  const t = encodeURIComponent(window.location.origin + window.location.pathname),    e = `https://alitems.com/g/${ke.ADMITAD_AE_PUBLISHER_ID}/?subid=${ke.ADMITAD_AE_SUB_ID}&ulp=${t}`;  Qt(e)};

The hardcoded affiliate identifiers

content-scripts/aliexpress.js
      VITE_CJS_IGNORE_WARNING: "true",      WXT_ADMITAD_AE_PUBLISHER_ID: "1e8d114494bb14f679c416525dc3e8",      WXT_ADMITAD_AE_SUB_ID: "AH",      WXT_ADMITAD_TEMU_CLICK_ID: "90cee36fae74afb8a1523d50f7705848",      WXT_ADMITAD_TEMU_PUB_ID: "604548",      WXT_ADMITAD_TEMU_PUB_NAME: "anhkhoa",

The content-script entry point

content-scripts/aliexpress.js
Qr = {  matches: ["*://*.aliexpress.com/*"],  runAt: "document_idle",  async main() {    if (!Wt()) return;    en();    const t = Yr(window.location.href);    if (!t) return;    const e = await Zr({        productIds: [t]      }),      n = e == null ? void 0 : e[t];    n && Xr({      promotionLink: n    })  }};
Captured request
POSThttps://minion.alihunter.io/promotion-generate?productId=1005003391567749&subid=AH

200 OK - {"promotion_link":"https://s.click.aliexpress.com/e/_c3CT77eX"}

Hosts the chain passes through
    • alitems.com

    Admitad's AliExpress affiliate redirector. Receives the address of the product page you are viewing in the ulp parameter and starts the attribution redirect chain.

    • ad.admitad.com

    Admitad affiliate network (Admitad GmbH). The response to the alitems.com request set UID and UID2 identifier cookies scoped to this domain.

    • s.click.aliexpress.com

    AliExpress's own affiliate click tracker. Sets the aeu_cid and af_ss_a / af_ss_b attribution cookies on .aliexpress.com and forwards you to the product page.

    • minion.alihunter.io

    Backend operated by the extension's publisher (Ali Hunter / Promer). Returns a per-product affiliate link for the product page you have open.

What we did and did not observe

We observed the AliExpress chain end to end in a single browsing session on 15 August 2026: the iframe injection, the request to alitems.com carrying the product page address, the attribution cookies set on .aliexpress.com and .ad.admitad.com, and the tagged AliExpress URL that the background service worker loaded. We did not make a purchase, so we cannot say what commission was actually paid on any transaction. The shipped bundle also contains a structurally identical injector in content-scripts/content.js that appends the same style of 0x0 transparent iframe pointing at temu.com with the same publisher's Admitad parameters when the page you are on is a Temu product page; that path was not exercised in our session, so it rests on code analysis alone.

What it can do

Permissions this extension asks for, as declared in version 3.2.0.10. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 4.2.0, which we have not unpacked yet.

  • Read and change your data on aliexpress.com

    *://*.aliexpress.com/*

  • Read and change your data on alitools.io

    https://*.alitools.io/*

  • Read and change your data on alihunter.io

    https://*.alihunter.io/*

  • Read and change your data on zopi.io

    https://*.zopi.io/*

  • Store data in your browser

    storage

  • Run its own code inside the pages you visit

    scripting

  • Show you desktop notifications

    notifications

  • Watch every request your browser makes

    webRequest

  • See every page you navigate to, as you navigate to it

    webNavigation

  • Read and change cookies, including the ones that keep you signed in

    cookies

Updated 30 September 2026mpajidobdpdigheplhpfggmeldjcpgfh