Is Sell The Trend - Winning Product Dropshipping safe?
Sell The Trend sends detected Shopify store hostnames and Facebook ad metadata to SellTheTrend services.
On ordinary webpages, the extension probes for Shopify product data and sends detected store hostnames with the SellTheTrend user ID to SellTheTrend APIs. On Facebook pages, it captures sponsored ad response metadata, builds ad and post details, adds the SellTheTrend login ID and public IP address, and posts the result to SellTheTrend's ad service.
Who publishes itSell The Trend Crop - no other listings under this identity
Sell The Trend Crop - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Sell The Trend checks every site you visit for Shopify and reports it
On every site you visit besides AliExpress, CJDropshipping, or Facebook, Sell The Trend's content script checks for a Shopify store and, without a click, sends the site's hostname to sellthetrend.com.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You visit any website other than AliExpress, CJDropshipping, or Facebook with the extension installed.
No click on the extension's icon or popup is needed.
The extension checks whether the site is a Shopify store, then sends the site's hostname to sellthetrend.com.
This runs on ordinary websites, not just the ecommerce sites named in the extension's own host permissions.
- Website hostnamewww.allbirds.com
Shows SellTheTrend which store you visited, even without you searching for it or opening the extension.
- Your account IDuid_58204 (illustrative)
When you're logged in to SellTheTrend, ties the visited store to your specific account.
- Content-Type
- application/json
{ "search": "www.allbirds.com"}The automatic Shopify probe and hostname report
Detects a Shopify storefront
// Detects whether the current page's own origin serves a Shopify-style// product feed. This runs on the page the user is visiting, not on// aliexpress.com/cjdropshipping.com/facebook.com.async function looksLikeShopifyStore() { try { const res = await fetch(`${window.location.origin}/products.json`); if (res.ok) { const data = await res.json(); return Array.isArray(data.products); } } catch {} return false;}Decides when to run the probe
// Runs once per page load (document_idle, <all_urls>, all frames).function detectPageType() { const [pageTypes, setPageTypes] = useState([]); useEffect(() => { (async () => { const url = new URL(window.location.href); const types = []; if (/aliexpress\.(com|us)/.test(url.hostname)) { types.push("AliExpress" /* + sub-type */); } else if (url.hostname.includes("cjdropshipping.com")) { types.push("CJD" /* + sub-type */); } else if (url.hostname.includes("facebook.com")) { types.push("Facebook" /* + sub-type */); } else if (await looksLikeShopifyStore()) { // Every other site on the web lands here. types.push("Shopify"); } setPageTypes(types); })(); }, []); return pageTypes;}Reports the hostname to SellTheTrend
// Called with window.location.hostname as soon as a page is classified// as "Shopify" (see detectPageType above).function useStoreIntelligence({ userAuthData, loading }) { return { setStoreIntelligence: async (hostname) => { if (loading) return; const { uid } = userAuthData; // undefined if not logged in to SellTheTrend const payload = { uid, search: hostname }; // POSTed with no user click on the extension, immediately after // the /products.json probe resolves. await api.post( "https://www.sellthetrend.com/api/store-intelligence/show", payload, { headers: { Authorization: "Bearer <app token>" } } ); }, };}- www.sellthetrend.com
SellTheTrend's own backend. Receives the hostname of every Shopify-shaped site you visit, plus your account ID when you're logged in.
Where it sends data
Destinations our analysis observed Sell The Trend - Winning Product Dropshipping contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- api.ipify.orgwidely used
Sell The Trend - Winning Product Dropshipping sends data to api.ipify.org. A widely used service: 41 other extensions we have analysed send data here.
- adsservice.sellthetrend.com
Sell The Trend - Winning Product Dropshipping sends data to adsservice.sellthetrend.com. No other extension we have analysed sends data here.
- www.sellthetrend.com
Sell The Trend - Winning Product Dropshipping sends data to www.sellthetrend.com. No other extension we have analysed sends data here.