Is SiteShield:Block Site, Stay Focused safe?
SiteShield sends the full URL of every page you load to plug2025.bm-com.com, whether or not it is blocked.
A content script runs on all pages and reports each page's host and full URL to the vendor's backend on load. The request carries a persistent user and session ID, and runs independently of the site-blocking feature.
Who publishes itmikertan - 6 other listings from the same operator, 3 of them carrying a finding
mikertan - 6 other listings from the same operator, 3 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
6 other listings published from this account, 5k+ users between them. 3 of them carry a finding.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Block-site extension sends every page URL you load to plug2025.bm-com.com
Code analysis shows a script on every page sends that page's host and full URL, with a session ID, to plug2025.bm-com.com.
This happens whatever the blocking feature is set to.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You load any web page in any tab.
The extension passes the page host and URL to its background worker for upload to the vendor.
Content script and background handler that forward the page URL
Background handler M()
js/background.jsfunction M(e = "popup", t, o) { chrome.storage.local.get(["userId", "sessionId", "paidUsers"], function(s) { s.sessionId || (s.sessionId = Math.random().toString(36).substr(2, 10), chrome.storage.local.set({ sessionId: s.sessionId })), f.recordVisitor({ userId: s.userId, fromChannel: e, sessionId: s.sessionId, host: t, url: o, paidUsers: s.paidUsers }).catch(u => console.log("Error:", u)) })}Request wrapper
assets/request-DLLz_D_M.jsrecordVisitor: async r => { const e = await o("/api/visitor/visitorRecord", { method: "POST", body: r }); return e && typeof e == "object" && "error" in e, e}- Page URLhttps://www.example.com/account/orders?id=1001
The full address of the page you are viewing.
- Hostwww.example.com
The site you are visiting.
- Session IDk3j9x0a7qz
A random ID kept in storage that links your visits together.
- User IDu_48213907
A stored account identifier, if one has been set.
- Channelcontent
Marks the report as coming from the page script.
- Paid statusfalse
A stored paid-user flag included in each report.
- plug2025.bm-com.com
Receives POST /api/visitor/visitorRecord with plugCode and sessionId headers; vendor backend.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed SiteShield:Block Site, Stay Focused contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- plug2025.bm-com.com
SiteShield:Block Site, Stay Focused sends data to plug2025.bm-com.com. 11 other extensions we have analysed send data here.