Is AliMedia | AliExpress image/video download safe?
AliMedia is medium risk. AliMedia sends your AliExpress page URL, install date, and a persistent random ID to api.alibill.net (developer-owned) and toriox.dev per download. A separate path sends URL, install/update dates, version to toriox.dev via a hardcoded key.…
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
AliMedia sends browsing URLs and install timestamps to third-party analytics
AliMedia sends your AliExpress page URL, install date, and a persistent random ID to api.alibill.net (developer-owned) and toriox.dev per download.
A separate path sends URL, install/update dates, version to toriox.dev via a hardcoded key.
You click a download button on an AliExpress product page.
The extension sends your persistent ID and the event name to api.alibill.net, and separately can send your page URL, install date, and unique ID to extension-monitor.toriox.dev.
Both transmissions occur in the background without notification.
| Content-Type | application/json |
{
"eventName": "CM_MAIN_IMAGE_DOWNLOADED",
"clientId": "oIRSBUstuVvukaVpSiKx",
"params": {
"website": "aliexpress"
}
}| Field | Value | Why it matters | |
|---|---|---|---|
Persistent user ID | oIRSBUstuVvukaVpSiKx | A 20-character random string generated at install and stored permanently, letting the server link your download activity across sessions. | |
Event name | CM_MAIN_IMAGE_DOWNLOADED | Names the specific action you took, such as downloading a main image or a video. | |
Website context | aliexpress | Records whether you were on AliExpress or Alibaba when the action occurred. |
| Field | Value | Why it matters | |
|---|---|---|---|
Current page URL | https://www.aliexpress.com/item/1005010698750600.html | The full URL of the AliExpress page you are viewing when you submit a report. | |
Install date | 2024-09-14T08:22:31.000Z | The timestamp when you first installed AliMedia, allowing servers to calculate how long you have been a user. | |
Persistent user ID | oIRSBUstuVvukaVpSiKx | Same permanent random ID used by the analytics endpoint, enabling cross-endpoint correlation of the same user. | |
Extension version | 3.1.14 | Reports the extension version installed. |
Analytics POST function in background.js (lines 3710-3726)
async function sendAnalytics(eventName, params = {}) {
const uniqueId = await getStorage(StorageKeys.UNIQUE_ID);
const clientId = typeof uniqueId === 'string' ? uniqueId.trim : '';
if (clientId.length === 0) return true;
const payload = { eventName, clientId, params };
await fetch('https://api.alibill.net/service/analytics/ga?extension=alimedia', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify(payload)
});
return true;
}- api.alibill.net
Developer-operated analytics backend. Receives event name, persistent user ID, and website context on every download action.
- extension-monitor.toriox.dev
Diagnostics endpoint. Receives page URL, install and update timestamps, extension version, and persistent user ID. Authenticated with a hardcoded API key in the extension source.
AliMedia rotates its affiliate redirect to dailyfinds.xyz
Clicking a product/store link on AliExpress or Alibaba sends the URL to the service worker, which opens a hidden tab to dailyfinds.xyz embedding your unique ID as a tracking param.
Same mechanism as C#4972; only domain/subid changed.
You click a product or store listing link on AliExpress or Alibaba.
The extension opens an off-screen background tab (active:false) to dailyfinds.xyz with your persistent unique ID and the product URL encoded as query parameters.
The tab loads without notifying you, then forwards your browser to the real product page tagged with affiliate referral parameters.
| Field | Value | Why it matters | |
|---|---|---|---|
Your persistent user ID | k7HnRdWqTpXeYc2Ls9Fz (illustrative) | Your unique ID is sent as subid1, letting the network link your clicks and purchases across sessions and attribute commissions. | |
Product URL you clicked | https://www.aliexpress.com/item/1005008194632967.html | The full URL of the product or store you were trying to visit is forwarded to the affiliate network before you arrive at the page. | |
Developer affiliate code | tf2qnpx0h5 | A fixed affiliate ID (tf2qnpx0h5) hardcoded in the extension routes purchase commissions to the extension developer. |
Affiliate redirect construction in background.js's chrome.runtime.onMessage ACTION handler
// Fires whenever a message with messageType === ACTION arrives at the background service worker
async function openAffiliateTab(message, sender) {
const storage = await getStorage();
const uniqueId = storage?.[StorageKeys.UNIQUE_ID] ?? '';
const productUrl = message?.url ?? 'https://aliexpress.com';
const affiliateUrl = `https://dailyfinds.xyz/cpa?subid=tf2qnpx0h5&link=${encodeURIComponent(productUrl)}&subid1=${uniqueId}`;
chrome.tabs.create({
active: false, // opens in the background, never takes focus
index: (sender?.tab?.index ?? 0) + 1,
url: affiliateUrl
});
}Content script product/store link interception in contentScript.js
const CLASS_MARKER = 'alm-3215sdagdsa';
const interceptProductLinks = (onFirstIntercept) => {
const intervalId = setInterval(() => {
if (alreadyFired) return clearInterval(intervalId);
document.querySelectorAll('[href]').forEach(el => {
if (el.classList.contains(CLASS_MARKER)) return;
const href = el.getAttribute('href');
const isProductLink = href && (href.includes('/item') || href.includes('/i/') ||
href.includes('/store') || href.includes('/product-detail/') ||
href.includes('/product/') || href.includes('/p/'));
if (!isProductLink) return;
el.classList.add(CLASS_MARKER);
const onClick = () => {
if (alreadyFired) return;
alreadyFired = true;
clearInterval(intervalId);
trackedElements.forEach((handler, node) => {
node.removeEventListener('click', handler);
node.classList.remove(CLASS_MARKER);
});
trackedElements.clear();
const cleanUrl = normalizeUrl(href);
if (cleanUrl) {
chrome.runtime.sendMessage({ messageType: ACTION, url: cleanUrl });
}
onFirstIntercept();
};
el.addEventListener('click', onClick, { once: true });
trackedElements.set(el, onClick);
});
}, 1000);
return intervalId;
};- dailyfinds.xyz
Affiliate redirect intermediary as of v3.3.3. Receives your unique ID and product URL, forwards to AliExpress with referral tags. Replaced purpleshades.xyz (C#4972).
- admitad.com
CPA affiliate marketing network. Final affiliate tracking platform; utm_source=admitad and utm_medium=cpa parameters confirmed in the captured redirect chain.