Is RatePunk Hotel Booking Deals safe?
RatePunk records every page's URL and sends hotel searches and prices to its servers, which can also direct it to fetch arbitrary URLs.
On every site you visit, RatePunk's content script writes the full page URL and a timestamp into local storage. On hotel and booking pages it scrapes hotel names, dates, occupancy and live prices (including the booking.com reserve price) and posts them to hotel-scraper.onrender.com and extension-analyzer.onrender.com, and it silently redirects bookings through affiliate-tagged links built from a remote config. Its background worker also honors a 'make_request' instruction from hotel-scraper.onrender.com: the server can tell the extension to fetch an arbitrary URL and return the response, repeating up to three times.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Full-URL Browsing Log Written on Every Page You Visit
We observed RatePunk write the full URL of every page you load, on any site, to storage as lastVisits with a timestamp, keeping the two most recent pages.
This buffer is read on booking sites to decide whether to auto-apply a referral.
You load any webpage while the extension is installed.
This fires on every site, not only travel or booking pages; the content script is injected into <all_urls>.
The extension records the page's full URL and a timestamp to local storage.
chrome.storage.local.lastVisits is overwritten with a rolling 2-entry buffer holding the current page and the one before it.
initialize.bundle.js, the <all_urls> content script that writes lastVisits on every page load
window.addEventListener("load", (() => {
((t, e) => {
const r = document.querySelector("html");
r.getAttribute(t) || (r.setAttribute(t, !0), (async () => {
const {
lastVisits: t
} = await ((t, e = "local") => new Promise(((r, n) => chrome.storage[e].get(...t, (t => r(t))))))(["lastVisits"]), e = new Date;
t ? chrome.storage.local.set({
lastVisits: [{
url: window.location.href,
date: e.toISOString()
}, t[0]]
}) : chrome.storage.local.set({
lastVisits: [{
url: window.location.href,
date: e.toISOString()
}]
})
})())
})("rp-extension")
}))chrome.storage.local after visiting agoda.com, expedia.com, priceline.com: only the two most recent URLs remain, earlier ones overwritten.
chrome.storage.local key 'lastVisits', observed after browsing agoda.com, expedia.com, and priceline.com in one dynamic-analysis session{
"lastVisits": [
{
"url": "https://www.priceline.com/",
"date": "2026-08-16T11:44:07.203Z"
},
{
"url": "https://www.priceline.com/",
"date": "2026-08-16T11:43:52.871Z"
}
]
}| Field | Value | Why it matters | |
|---|---|---|---|
Page URL | https://www.priceline.com/drive/results?pickupLocation=SFO | The full address of the page you're on, including path and query, enough to identify the specific page and search you viewed. | |
Visit timestamp | 2026-08-16T11:44:07.203Z | The exact moment you loaded that page. |
You land on a supported booking site, such as booking.com.
The affiliate content script for that site (e.g. booking.bundle.js) loads and checks the stored lastVisits buffer before acting.
The extension reads the last two recorded page URLs to decide whether to auto-apply a referral redirect.
If the previously recorded URL already matches the booking site's own domain, the extension treats you as already redirected and skips applying a second referral link.