Is China Planet: VIP podpora pre vaše nákupy z Číny safe?
China Planet redirects some shopping product pages through affiliate links that include the page URL.
On Soundcore product pages, the extension forwards the current page URL to Admitad before replacing the page with the affiliate URL. On Geekbuying item pages, it removes existing affiliate tracking parameters and redirects through Geekbuying's affiliate deeplink with the cleaned product URL.
Who publishes itChina Planet - no other listings under this identity
China Planet - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Geekbuying product pages are redirected through a partner link first
On a geekbuying.com item page, the extension strips referral params and redirects to affiliate.geekbuying.com/deeplink.php (ID 3983) before the page loads.
It 301s back, sets a 30-day idev cookie, sent on 17 later requests, unannounced.
- Severity
- Low vulnerability
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open a product page on geekbuying.com.
In our test session the address was https://www.geekbuying.com/item, opened with no referral cookie in the browser.
The extension immediately sends the tab to an affiliate link that credits partner 3983, then returns you to the same product page.
The round trip took 0.3 seconds and needed no click or confirmation from you; the page you asked for is the page you end up on, with tracking parameters added.
301 redirect to https://www.geekbuying.com/item?idev_id=3983&idev_subid=extension&utm_source=affiliate.geekbuying.com&utm_medium=affiliate_3983&utm_campaign=3983&utm_content=3983&utm_term=chinaplanet1130349, with two cookies set on the response.
- Cookie
- vaya_IsRefreshIP=1; vaya_LastIPCountryCode=GB; vaya_CountryCode=GB; vaya_AreaId=6; vaya_Currency=GBP
- Set-Cookie (response)
- _s=g1bh2467a7ov9bai7m3nplrt2j; path=/; HttpOnly idev=3983-https%3A%2F%2Fwww.geekbuying.com%2F-0-0--extension-----https%3A%2F%2Fwww.geekbuying.com%2Fitem; expires=Mon, 14-Sep-2026 16:50:28 GMT; Max-Age=2592000; path=/; domain=.geekbuying.com
- The product page you asked forurl=https%3A%2F%2Fwww.geekbuying.com%2Fitem
The address of the page you opened, sent to the affiliate service so it can return you there. The only activity that leaves the browser.
- Credited partner accountaffid=3983
A fixed partner number that tells the shop who to pay commission to for anything you buy on this visit.
- Visit source labelsub_id=extension
Distinguishes visits sent by this extension from the same partner's other traffic sources.
- The partner cookie left in your browseridev=3983-https%3A%2F%2Fwww.geekbuying.com%2F-0-0--extension-----https%3A%2F%2Fwww.geekbuying.com%2Fitem; Max-Age=2592000; domain=.geekbuying.com
Stored on geekbuying.com for 30 days. Purchases made in that time stay credited to the same partner, even if you return on your own later.
- Affiliate session identifier_s=g1bh2467a7ov9bai7m3nplrt2j
A per-browser identifier set by the affiliate service on the same visit, which lets it recognise the same browser on later requests.
- Click reference on returnutm_term=chinaplanet1130349
A per-click reference the affiliate service appends to the return address, tying this visit to the extension's campaign.
The 30-day cookie the affiliate service leaves behind is URL-encoded, so it reads as one long string in the browser's cookie jar. Decoded, it is a record of who gets credited and which page you were sent to.
idev = 3983-https://www.geekbuying.com/-0-0--extension-----https://www.geekbuying.com/itemfield 1 3983 partner id credited for the visitfield 2 https://www.geekbuying.com/ the shop the partner link pointed atfield 3 0field 4 0field 5 (empty)field 6 extension sub-id supplied by the extensionfields 7-10 (empty)field 11 https://www.geekbuying.com/item the product page originally openedexpires Mon, 14-Sep-2026 16:50:28 GMT (Max-Age 2592000 = 30 days)domain .geekbuying.com sent to every geekbuying.com hostThe whole content script: check for the partner's parameters, otherwise strip and redirect
Same file, annotated
affiliates/geekbuying.js// affiliates/geekbuying.js — runs at document_start on *://*.geekbuying.com/item*// (manifest.json content_scripts entry #2). Annotated below; the file ships// unminified, so the code text is unchanged apart from these comments.// Helper: returns `url` with the named query parameter removed.function removeQueryParam(url, param) { // Split the URL into base and query string const urlParts = url.split('?'); // If there's no query string or the param doesn't exist, return the URL as it is if (urlParts.length < 2 || url.indexOf(param + '=') === -1) { return url; } const baseUrl = urlParts[0]; const queryString = urlParts[1]; // Split the query string into key-value pairs const queryParams = queryString.split('&'); // Filter out the parameter to be removed const filteredParams = queryParams.filter(function (paramPair) { return paramPair.split('=')[0] !== param; }); // Reconstruct the query string const newQueryString = filteredParams.join('&'); // Rebuild the URL return baseUrl + (newQueryString ? '?' + newQueryString : '');}// The address of the product page the user opened.const url = window.location.href;// GUARD: do nothing only if the address ALREADY carries this partner's full// referral parameter set (partner 3983 or 764, sub-id extension /// xiaomiplanet / kuponovyportal). Any other state — including a competing// partner's parameters — falls through to the redirect branch below.if ( (url.includes("idev_id=764") || url.includes("idev_id=3983")) && (url.includes("idev_subid=xiaomiplanet") || url.includes("idev_subid=kuponovyportal") || url.includes("idev_subid=extension")) && url.includes("utm_source=affiliate.geekbuying.com") && (url.includes("utm_medium=affiliate_764") || url.includes("utm_medium=affiliate_3983")) && (url.includes("utm_campaign=764") || url.includes("utm_campaign=3983")) && (url.includes("utm_content=764") || url.includes("utm_content=3983"))) { // "url je okej" (Slovak: "the url is okay") — leave the page alone.} else { // STRIP: remove any referral / campaign parameters already on the address, // including ones placed there by a different referrer. let clean_url = removeQueryParam(url, "idev_id"); clean_url = removeQueryParam(clean_url, "idev_subid"); clean_url = removeQueryParam(clean_url, "utm_source"); clean_url = removeQueryParam(clean_url, "utm_medium"); clean_url = removeQueryParam(clean_url, "utm_campaign"); clean_url = removeQueryParam(clean_url, "utm_content"); clean_url = removeQueryParam(clean_url, "utm_term"); // REDIRECT: send the tab through the affiliate service with partner id // 3983 and sub-id "extension", carrying the cleaned address in `url=`. const new_url = "https://affiliate.geekbuying.com/deeplink.php?affid=3983&sub_id=extension&url=" + encodeURIComponent(clean_url); location.replace(new_url); // top-level navigation, no user interaction}- affiliate.geekbuying.com
Geekbuying's affiliate/deeplink service. Gets the product page address, records the visit for partner 3983, sets a 30-day idev cookie plus a session cookie, and 301s you back.
- www.geekbuying.com
The shop itself: the page you asked for, returned to you with idev_id, idev_subid and utm_* appended. Gets the partner cookie on later requests in the session.
Only the address of the product page left the browser. In the captured session the script did not read cookies, form inputs or page content, used no privileged Chrome APIs, and the manifest confines it to geekbuying.com item pages, so it cannot act on other sites. Affiliate redirection is ordinary behaviour for a shopping-support extension, and the destination is the shop's own affiliate service rather than a third party; what is recorded here is that it happens on every matching page without a prompt, that it replaces referral parameters already on the address, and that the resulting credit persists in your browser for 30 days.
Where it sends data
Destinations our analysis observed China Planet: VIP podpora pre vaše nákupy z Číny contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- ad.admitad.com
China Planet: VIP podpora pre vaše nákupy z Číny sends data to ad.admitad.com. One other extension we have analysed sends data here.
- affiliate.geekbuying.com
China Planet: VIP podpora pre vaše nákupy z Číny sends data to affiliate.geekbuying.com. No other extension we have analysed sends data here.