Is Viral Vue for Amazon Influencers & Associates safe?
Viral Vue sends supported-site page URLs to api-iris.viralvue.com during session checks.
When Viral Vue runs on supported pages, its session validation request includes the current page URL as an x-referer header. That sends the visited supported-site URL or referrer to ViralVue's API during startup and navigation checks.
Who publishes itViral Vue LLC - no other listings under this identity, 2 shared hostnames
Viral Vue LLC - no other listings under this identity, 2 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 2 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Current Page URL Sent to ViralVue on Page Load
Viral Vue checks session validity on every supported page load, Amazon, YouTube Studio, Canva, Pinterest, before you touch it, sending the page URL to ViralVue's servers in a header.
A planted marker URL reached api-iris.viralvue.com.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open a supported page, like an Amazon listing or your YouTube Studio dashboard.
No click on the extension icon or any extension UI is required.
The extension automatically sends the page's URL to ViralVue's servers as part of a session-validation check.
The URL travels in a request header, not the request body.
Page URL captured by the content script, attached by the shared fetch helper
Content-script wrapper, renamed for readability
async function callBackgroundApi(request) { const { endpoint, options = {}, priority = "low", regionOverride } = request; try { // Capture the URL of the page the content script is running on. const currentPageUrl = new URL(window.location.href); await ensureReady(); const result = await fetchManager.handleFetchRequest( { endpoint, options, priority, regionOverride, noRedirect: request.noRedirect || false, }, currentPageUrl // passed through so it can be attached to the outgoing request ); if (!result.ok) throw result.error; return result; } catch (err) { return { ok: false, error: normalizeError(err) }; }}FetchManager method, renamed for readability
async handleFetchRequest(request, currentPageUrl) { try { if (!this.ready) { this.logger.info("FetchManager not ready, loading token..."); this.loadAccessToken(); } this.updateRegion(currentPageUrl); let url = request.endpoint; const isRelative = url.startsWith("/"); const noRedirect = request.noRedirect || false; // Every relative-endpoint call gets the current page URL attached // as a request header -- not just the session-validation call. const fetchOptions = isRelative ? { ...request.options, headers: { ...request.options.headers, "x-referer": currentPageUrl.href } } : { ...request.options, headers: { ...request.options.headers } }; if (isRelative) { const apiUrl = new URL(url, API_BASE); apiUrl.searchParams.set("region", request.regionOverride ?? this.region); url = apiUrl.toString(); fetchOptions.headers = { ...fetchOptions.headers, "X-Access-Token": this.accessToken || "none" }; fetchOptions.credentials = "include"; } if (request.compression === "gzip") { fetchOptions.headers["Content-Encoding"] = "gzip"; fetchOptions.body = gzip(fetchOptions.body); } fetchOptions.redirect = noRedirect ? "manual" : "follow"; return await this.enqueue(url, fetchOptions, isRelative, request.priority); } catch (err) { this.logger.warn("Error handling", request.endpoint, request.options.method || "GET", ":", err); return { ok: false, error: normalizeError(err) }; }}200 OK. We planted a marker value in the active tab's URL and observed it echoed back in this request's x-referer header, confirming the current page URL leaves the device on this call.
- x-referer
- https://www.amazon.com/dp/B0EXAMPLE123/ref=cm_sw_r_apin (illustrative — the exact URL of the page open in the active tab)
- Page you're viewinghttps://www.amazon.com/dp/B0EXAMPLE123/ref=cm_sw_r_apin (illustrative)
The exact web address of the page open in your browser when the automatic session check fires.
- Feature-flag session key0e7086320fceaa74eab6691f54a484b036d37aa2a3cdb2b86525bdab3b18021
A hashed key tied to your account's feature-flag state, sent alongside the page URL so ViralVue can associate the visit with your session.
- api-iris.viralvue.com
ViralVue's own backend API. Receives your current page URL in the x-referer header on the automatic session-validation call fired whenever a supported page loads.
Where it sends data
Destinations our analysis observed Viral Vue for Amazon Influencers & Associates contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- api-iris.viralvue.com
Viral Vue for Amazon Influencers & Associates sends data to api-iris.viralvue.com. No other extension we have analysed sends data here.