Is Obsignals safe?
Obsignals is medium risk. Obsignals rewrites the active tab's URL when it matches any of 12 binary-options broker sites, appending an affiliate code from painel.obsignals.com via chrome.tabs.update, e.g. qxbroker.com/en?lid=192387. Seen live on 3 of 12 domains.
Who publishes itobsignals - no other listings under this identity, 2 shared hostnames
obsignals - no other listings under this identity, 2 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 2 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Undisclosed Affiliate Redirect on Broker Site Visits
Obsignals rewrites the active tab's URL when it matches any of 12 binary-options broker sites, appending an affiliate code from painel.obsignals.com via chrome.tabs.update, e.g. qxbroker.com/en?lid=192387.
Seen live on 3 of 12 domains.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
You navigate to a supported broker site, such as qxbroker.com or pocketoption.com.
The background service worker reloads your tab with an affiliate referral parameter appended to the URL, without a notification.
Confirmed via dynamic analysis: chrome.tabs.update fired within 1-4 seconds of the page load on 3 of the 12 listed broker domains.
- qxbroker.com redirecthttps://qxbroker.com/en?lid=192387
Your tab reloads with a referral ID appended, attributing any signup or deposit on this broker to Obsignals.
- pocketoption.com redirecthttps://pocketoption.com/en?smart=bAC2FB7mlcHtwv
Your tab reloads with a different referral ID appended for this broker.
- olymptrade.com redirecthttps://olymptrade.com/?affiliate_id=1573874&subid1=&subid2=
Your tab reloads with a referral ID appended for this broker.
- Total broker domains configuredqxbroker.com, iqoption.com, pocketoption.com, exnova.com, expertoption.com, bull-ex.com, olymptrade.com, binolla.com, binomo.com, capitalbear.com, optinary.com, iqcent.com
12 broker domains are configured server-side as redirect targets; only 3 were exercised during live testing.
Ships unminified, human-readable source; code below is exactly as packaged, no deobfuscation needed.
Remote affiliate config fetch
background.jsconst url = "https://painel.obsignals.com/api";const fetchPlatform = (async () => fetch(`${url}/get/platformas`) .then((response) => { return response.json() }) .then((data) => data))();Tab redirect on matching broker navigation
background.jschrome.tabs.onUpdated.addListener((tabId, changeInfo, tab) => { fetchPlatform.then((platforms) => { if (changeInfo.status !== "complete") { return; } platforms.plataformas.map((item) => { const atributeRedirect = item.atributo_redirecionamento; const code = item.codigo; const atribute = `${atributeRedirect}=${code}`; const domain = item.dominio; if (tab.url.includes(domain) && !tab.url.includes(atribute)) { changeUrl(atribute); } }); }); function changeUrl(atribute) { chrome.tabs.query({ currentWindow: true, active: true }, (tab) => { const url = tab[0].url; chrome.tabs.update(tab.id, { url: `${url}?${atribute}`, }); }); }});200 OK. Captured as an automatic second top-level navigation (initiator.type=other, no user click) 1.3-3.8 seconds after the initial page load.
- qxbroker.com
Broker site; captured redirect appended lid=192387 on live navigation.
- pocketoption.com
Broker site; captured redirect appended smart=bAC2FB7mlcHtwv on live navigation.
- olymptrade.com
Broker site; captured redirect appended affiliate_id=1573874 on live navigation.
- iqoption.com
- exnova.com
- expertoption.com
- bull-ex.com
- binolla.com
- binomo.com
- capitalbear.com
- optinary.com
- iqcent.com
Broker site listed in the extension's remote affiliate config; not exercised during testing.
What it can do
Permissions this extension asks for, as declared in version 6.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
See the address and title of every tab you have open
tabs
Show you desktop notifications
notifications