Is Amazon Product Finder - AMZScout PRO Extension safe?

Medium risk

AMZScout PRO keeps a WebSocket open to its server and runs server-pushed Amazon page fetches using your session.

The background worker connects to ws.amzscout.net and receives tasks telling it which Amazon product and review pages to fetch and parse. These requests include your Amazon cookies and run without any user interaction, and the parsed results are sent back to the server.

AMZScoutv2.5.7.1Chrome Web Store
49Risk
Who publishes it

AMZscout Corp. - 6 other listings from the same operator, 2 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
AMZScout
Declared legal entity
AMZscout Corp.
Registered address
1735 Market Street Suite 3750, Philadelphia, PA 19103, United States

Same store account

6 other listings published from this account, 190k+ users between them. 2 of them carry a finding.

FBA Calculator100k+MediumAMZScout Stock Stats30k+CleanQuick View20k+HighAI Amazon Product Research - AMZScout PRO AI Extension20k+CleanOnline Dropshipping and Arbitrage10k+CleanKeyword Tracker by AMZScout10k+Clean

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

amzscout.net
Also called by 4 other listings, including ZeeDrop, ADM Crosslister

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

AMZScout fetches Amazon pages in your session on tasks pushed by its server

Code analysis shows a background socket to ws.amzscout.net that receives tasks, fetches Amazon pages with your logged-in cookies, and returns the parsed results to the server.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

The AMZScout server pushes a task or update event over the open socket.

The extension did this

The extension fetches the listed Amazon pages using your logged-in session and sends the parsed result back.

The code that does this

Socket endpoint, reconnect and message dispatch

Readable version

Endpoint and storage key

background.js
    y = "wss://".concat("ws.amzscout.net", "/so/"),    d = "".concat("SCOUT_EXT_PRO", "-next-delay-run"),

Hourly poller

background.js
        value: function closeConnection(t) {          var r = this;          setTimeout((function() {            return r.connect()          }), 15e3)        }      }, {        key: "onMessage",        value: function onMessage(t) {

Event dispatch

background.js
              this.onStop(r.data);              break;            case "reviews":              this.doParseReview(r.data).then((function(t) {}));              break;            case "analyzer":              this.doParseAnalyzer(r.data).then((function(t) {}))          }        }      }, {        key: "onError",        value: function onError(t) {}      }, {        key: "sendMessage",        value: function sendMessage(t) {          this.socket.send(JSON.stringify(t))        }      }, {        key: "onUpdate",
The code that does this

Server-supplied task starts a fetch job

Readable version
background.js
        }      }, {        key: "onTask",        value: function onTask(t) {          var r = this;          try {            var o = JSON.parse(t),              i = o && o.id || void 0,              a = chrome.runtime.getManifest(),
What the socket carries
  • Server endpoint
    wss://ws.amzscout.net/so/?software=SCOUT_EXT_PRO&version=2.5.6.8

    The extension keeps a live line open to this AMZScout host.

  • Task input
    {"id":"t-1","asins":["B08N5WRWNW"],"domain":"com"}

    The server chooses which Amazon product or review pages are loaded.

  • Session on requests
    credentials: include

    Fetches are sent with your Amazon cookies attached.

  • Result
    {"event":"task","data":"..."}

    The parsed page content is sent back to the server.

When this fires

Every 1 hour

The socket is reopened every hour, retried 15 seconds after a close, and a keepalive is sent every 20 seconds.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed AMZScout PRO contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • ws.amzscout.net

    AMZScout PRO sends data to ws.amzscout.net. 3 other extensions we have analyzed send data here.

Updated 15 October 2026njopapoodmifmcogpingplfphojnfeea