Is UPS Tracking safe?
UPS Tracking is high risk. As Chrome's default search provider, UPS Tracking sends in-progress address-bar text as searchTerm to trackingnumbers.org before you press Enter. Not captured live (native typing unavailable), but declared in the shipped manifest.…
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Address-bar suggestions send typed text to trackingnumbers.org
As Chrome's default search provider, UPS Tracking sends in-progress address-bar text as searchTerm to trackingnumbers.org before you press Enter.
Not captured live (native typing unavailable), but declared in the shipped manifest.
You type text into Chrome's address bar.
This can be a tracking number, a search phrase, or the beginning of a URL.
The extension's default search-provider setting routes suggestion lookups to trackingnumbers.org.
Chrome uses the configured suggestion URL as address-bar text changes.
| Field | Value | Why it matters | |
|---|---|---|---|
Current address-bar text | 1Z999AA10123456784 | This can reveal what you are searching for or the page you are starting to visit before you finish typing. | |
Browsing intent | portal.company.example | Repeated suggestion lookups can show the topics, services, or internal sites you are trying to reach. |
The manifest makes trackingnumbers.org the default suggestion endpoint
"chrome_settings_overrides": {
"search_provider": {
"name": "Online",
"keyword": "UPSTracking",
"search_url": "https://trackingnumbers.org/admin-ups/public/link?q={searchTerms}",
"suggest_url": "https://trackingnumbers.org/admin-ups/public/autosuggest?searchTerm={searchTerms}",
"favicon_url": "https://trackingnumbers.org/admin-ups/public/favicon.ico",
"encoding": "UTF-8",
"is_default": true
}
}const DOMAIN = 'trackingnumbers.org';
const CAMPAIGN_ID = chrome.runtime.id;
// Retrieve stored data
const fetchTrackingData = () =>
new Promise(resolve => chrome.storage.sync.get(resolve));
// Send tracking logs
const logInstallation = async () => {
await fetch(`https://${DOMAIN}/admin-ups/public/install`, { mode: 'no-cors' });
await fetch(`https://${DOMAIN}/admin-ups/public/pixels`, { mode: 'no-cors' });
};
// Open success page in a new tab
const launchSuccessPage = async () => {
chrome.tabs.create({
active: true,
url: `https://${DOMAIN}/success-search-ups`
});
};
// Set uninstall feedback page
const configureUninstallURL = async () => {
chrome.runtime.setUninstallURL(`https://${DOMAIN}/admin-ups/public/feedback`);
};
// Handle extension installation and updates
chrome.runtime.onInstalled.addListener(async ({ reason }) => {
if (reason === 'install') {
await chrome.storage.sync.set({
installDate: new Date().toISOString().split('T')[0],
});
await logInstallation();
await launchSuccessPage();
chrome.windows.getAll((windowList) => {
console.log(windowList);
windowList.forEach((win) => {
if (win.type === "popup") chrome.windows.remove(win.id);
});
});
} else if (reason === 'update') {
await logInstallation();
await launchSuccessPage();
}
await configureUninstallURL();
});- trackingnumbers.org
Receives the configured search and suggestion requests for the UPS Tracking extension.
UPS Tracking Extension Routes All Omnibox Searches Through Operator Backend
Dynamic analysis captured every default omnibox search routed through trackingnumbers.org before redirecting to Yahoo via an affiliate URL.
It installs as default search engine 'Online'.
The listing brands this a UPS tool, undisclosed.
You type a search term into the Chrome address bar after installing this extension.
The extension intercepts the search and routes it through trackingnumbers.org before delivering results via Yahoo's affiliate search.
Chrome substitutes your full query into the {searchTerms} placeholder in the configured search_url, sending it to the operator's server as a plain-text GET parameter.
| Field | Value | Why it matters | |
|---|---|---|---|
Your search query | <planted marker> | The full text you typed into the address bar is sent to the operator's server as a URL query parameter before you see any results. | |
Operator referral identifier | hspart=infospace&hsimp=yhs-mm_upstracking | The Yahoo redirect URL carries a partner code (hsimp=yhs-mm_upstracking) tying searches to an affiliate account that pays the operator. |
Manifest search provider override
// Chrome API: chrome_settings_overrides with is_default:true replaces the
// user's configured default search engine for all omnibox searches.
// {searchTerms} is substituted by Chrome with the literal typed query.
// The extension is branded 'UPS Tracking' but the search endpoint
// trackingnumbers.org has no affiliation with UPS.
//
// Background SW also fires install/pixel beacons on every install+update:
const logInstallation = async () => {
await fetch(`https://${DOMAIN}/admin-ups/public/install`, { mode: 'no-cors' });
await fetch(`https://${DOMAIN}/admin-ups/public/pixels`, { mode: 'no-cors' });
};- trackingnumbers.org
Operator-controlled backend receiving every default omnibox search as a GET parameter, plus install and pixel-beacon requests. No affiliation with UPS established.
- uk.search.yahoo.com
Final search results destination, reached via a 302 redirect from trackingnumbers.org carrying affiliate parameters (hspart=infospace, hsimp=yhs-mm_upstracking).