Is RatePunk Hotel Booking Deals safe?
RatePunk records every page's URL and sends hotel searches and prices to its servers, which can also direct it to fetch arbitrary URLs.
On every site you visit, RatePunk's content script writes the full page URL and a timestamp into local storage. On hotel and booking pages it scrapes hotel names, dates, occupancy and live prices (including the booking.com reserve price) and posts them to hotel-scraper.onrender.com and extension-analyzer.onrender.com, and it silently redirects bookings through affiliate-tagged links built from a remote config. Its background worker also honors a 'make_request' instruction from hotel-scraper.onrender.com: the server can tell the extension to fetch an arbitrary URL and return the response, repeating up to three times.
Who publishes itUAB Yard Venture - no other listings under this identity, 10 shared hostnames
UAB Yard Venture - no other listings under this identity, 10 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 10 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Full-URL Browsing Log Written on Every Page You Visit
We observed RatePunk write the full URL of every page you load, on any site, to storage as lastVisits with a timestamp, keeping the two most recent pages.
This buffer is read on booking sites to decide whether to auto-apply a referral.
What actually happens
You load any webpage while the extension is installed.
This fires on every site, not only travel or booking pages; the content script is injected into <all_urls>.
The extension records the page's full URL and a timestamp to local storage.
chrome.storage.local.lastVisits is overwritten with a rolling 2-entry buffer holding the current page and the one before it.
The code that does this
initialize.bundle.js, the <all_urls> content script that writes lastVisits on every page load
window.addEventListener("load", (() => { ((t, e) => { const r = document.querySelector("html"); r.getAttribute(t) || (r.setAttribute(t, !0), (async () => { const { lastVisits: t } = await ((t, e = "local") => new Promise(((r, n) => chrome.storage[e].get(...t, (t => r(t))))))(["lastVisits"]), e = new Date; t ? chrome.storage.local.set({ lastVisits: [{ url: window.location.href, date: e.toISOString() }, t[0]] }) : chrome.storage.local.set({ lastVisits: [{ url: window.location.href, date: e.toISOString() }] }) })()) })("rp-extension")}))What's stored on your device
chrome.storage.local after visiting agoda.com, expedia.com, priceline.com: only the two most recent URLs remain, earlier ones overwritten.
- Location
- chrome.storage.local key 'lastVisits', observed after browsing agoda.com, expedia.com, and priceline.com in one dynamic-analysis session
{ "lastVisits": [ { "url": "https://www.priceline.com/", "date": "2026-08-16T11:44:07.203Z" }, { "url": "https://www.priceline.com/", "date": "2026-08-16T11:43:52.871Z" } ]}What's captured in each lastVisits entry
- Page URLhttps://www.priceline.com/drive/results?pickupLocation=SFO
The full address of the page you're on, including path and query, enough to identify the specific page and search you viewed.
- Visit timestamp2026-08-16T11:44:07.203Z
The exact moment you loaded that page.
What actually happens
You land on a supported booking site, such as booking.com.
The affiliate content script for that site (e.g. booking.bundle.js) loads and checks the stored lastVisits buffer before acting.
The extension reads the last two recorded page URLs to decide whether to auto-apply a referral redirect.
If the previously recorded URL already matches the booking site's own domain, the extension treats you as already redirected and skips applying a second referral link.
Where it sends data
Destinations our analysis observed RatePunk Hotel Booking Deals contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- ipapi.co
RatePunk Hotel Booking Deals sends data to ipapi.co. 20 other extensions we have analyzed send data here.
- extension-analyzer.onrender.com
RatePunk Hotel Booking Deals sends data to extension-analyzer.onrender.com. No other extension we have analyzed sends data here.
- hotel-scraper-eu.onrender.com
RatePunk Hotel Booking Deals sends data to hotel-scraper-eu.onrender.com. No other extension we have analyzed sends data here.
- hotel-scraper.onrender.com
RatePunk Hotel Booking Deals sends data to hotel-scraper.onrender.com. No other extension we have analyzed sends data here.