Is Check My Links safe?
Check My Links is medium risk. When the UI loads, the extension checks a stored last-hit date. If the counter hasn't fired today, it GETs checkmylinks.selectorshub.info with a Check My Links header and stores today's date, so the vendor gets your IP and a daily signal.
Who publishes itSelectorsHub Tech Private Limited - 10 other listings from the same operator, 3 of them carrying a finding
SelectorsHub Tech Private Limited - 10 other listings from the same operator, 3 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
6 other listings published from this account, 52k+ users between them. 1 of them carries a finding.
Same operator - 4 listings
Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Daily popup counter sends your IP address to the vendor
When the UI loads, the extension checks a stored last-hit date.
If the counter hasn't fired today, it GETs checkmylinks.selectorshub.info with a Check My Links header and stores today's date, so the vendor gets your IP and a daily signal.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open the Check My Links interface.
The extension page loads scripts that include the login and account-status code.
The extension sends a daily counter request when today's date is not already saved.
After a successful request, it stores today's date so the same browser profile does not send the counter again that day.
- D
- checkmylink
- Content-type
- application/json
- Your IP address198.51.100.24 (illustrative)
The vendor server sees the network address that made the daily counter request. That can identify your network or approximate location.
- Daily use of the extension2026-07-14: first Check My Links UI load of the day
A successful request shows that your browser profile opened the Check My Links interface on that date.
- Extension product markerD: checkmylink
The request labels itself as coming from Check My Links, so the endpoint can separate this traffic from other products.
This saved date lets the extension remember that your browser profile already sent the counter request for the day.
- Location
- chrome.storage.local key user_counter_last_hit_date
{ "user_counter_last_hit_date": "2026-07-14"}The shipped code that gates and sends the daily counter request
The extension UI loads login.js
pages/linkreport.html<script src="/lib/jq.js"></script><!-- <script src="/lib/notify.js"></script> --> <!-- <script src="/lib/jquery-3.5.1.slim.min.js"></script> --> <script src="/lib/popper.min.js"></script> <script src="/lib/bootstrap.min.js"></script> <script src="/lib/confetti.browser.min.js"></script> <script src="/js/constants.js"></script> <script src="/js/popup.js"></script> <script src="/js/login.js"></script> <script src="/js/pt.js"></script> <script src="/js/exclude.js"></script>Readable counter function in login.js
js/login.jsvar endpoint = "https://checkmylinks.selectorshub.info/";hitCounterApiIfDateChanged();function hitCounterApiIfDateChanged() { const e = (new Date).toISOString().split("T")[0]; chrome.storage.local.get(["user_counter_last_hit_date"], function(a) { a.user_counter_last_hit_date !== e && $.ajax({ method: "GET", url: endpoint + "user/counter", beforeSend: function(b) { b.setRequestHeader("Content-type", "application/json"); b.setRequestHeader("D", "checkmylink") }, success: function(b) { b = {}; b.user_counter_last_hit_date = e; chrome.storage.local.set(b, function() {}) }, error: function(b, c, d) {}, statusCode: { 500: function() {}, 401: function() {} } }) })}- checkmylinks.selectorshub.info
Receives the daily Check My Links counter GET request and the request header identifying the product.