Brentford Football Club

The extension silently POSTs a per-installation user hash and an engagement score to a Google Cloud Function hosted under searchturbo-com — a domain belonging to the publisher's sister product 'SearchTurbo', not to brandturbo.vip or Brentford FC. The CWS listing declares zero data collection categories, making this an undisclosed transmission of user-identifying behavioral data to a third-party endpoint.

var D, F = "https://m.instantsearch.net/stats";localStorage.firstRun || (localStorage.firstRun = Date.now());var C = parseInt(localStorage.firstRun);var N = function(t, e) {  var r = D.getState().config.data;  fetch("".concat("https://europe-west1-api-searchturbo-com.cloudfunctions.net/invite-function/api",    "/scores"), {    method: "POST",    headers: {      "Content-Type": "application/json"    },    body: JSON.stringify({      hash: t,      score: e,      rtag: r.rtag    })  })};

Every time the news panel is rendered, the extension contacts Jeeng (a push-notification ad-monetization platform) at azurewebsites.net with a hardcoded domain_id and user_id. Jeeng is entirely unrelated to Brentford FC or a new-tab reading experience; its presence indicates the extension's real purpose is monetizing its user base through undisclosed ad delivery, consistent with the publisher's known pattern of wrapping monetization SDKs in sports-club branding.

(0, s.useEffect)((function() {  O(i, c.rtag, d), b || function(e) {    e({      name: "ads",      url: "https://jeeng-server.azurewebsites.net/api/push-monetization?domain_id=3AJmqgQdl1&user_id=bfd230b1-7688-43a4-bb68-ce1a5ff305d2&count=5"    })  }(i)}), [c.rtag, h]);

On every tracked user interaction, an analytics beacon is dispatched to `https://m.instantsearch.net/stats` carrying event type, event value, rtag identifier, source flag 'e', JS version and time-since-install. This domain is not the publisher's declared domain (brandturbo.vip), and the CWS data-collection disclosure is empty — this constitutes undisclosed behavioral tracking sent to a third-party infrastructure domain.

t.async ? function(t, e) {  var r = arguments.length > 2 && void 0 !== arguments[2] ? arguments[2] : function() {};  navigator.sendBeacon ? r(navigator.sendBeacon(t, JSON.stringify(e))) : r(!1)}(F, i, t.status) : M(F, i, t.status);