Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Custom Engines

CRITICAL RISKRemoved from Chrome Web Store

Custom Engines

ID: mkacjhofeafagblkflacbogbkdcmeabf

Could be malicious

Extension Info & Metadata

Status

Removed

Version

1.1

Size

0.13 MB

Rating

4.3/5

Reviews

Users

158,677

Type

Extension

Updated

Jan 11, 2021

Publisher Contextual Analysis

Author: Kyle LoView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

158,677

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Add support to the omnibox dropdown to use in a preferred search engine

Quickly access alternative Search Engines when browsing. Simply type 'q' and press the space button in your browser address bar before typing your search keyword and choose your preferred search engine from the autofill section. Additionally, by clicking on the browser Icon, you can choose your default Search Engine that is always activated when you navigate your searches via address bar.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High5

Medium3

Low1

Versions scanned

Showing 1 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.1 Code review	12

Extension Version	Code Review Findings
1.1	12

Files with findings

2 distinct paths — top paths by unique finding count:

background.js10
eventPage.js2

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	background.js (line 318)	This function dynamically constructs a JavaScript string using a server-supplied value (`linkvDiv`) and injects it into every open Linkvertise/link-to.net tab via `chrome.tabs.executeScript`. The injected code string …	1.1
2	Network Interception	critical	background.js (line 507)	The extension registers a `webRequest.onBeforeSendHeaders` listener on `<all_urls>`, giving it visibility into the headers and URLs of every outgoing HTTP/S request across all tabs. When a Google/Bing/Ecosia/Wikipedia…	1.1
3	Remote Code Loading	critical	background.js (line 268)	The extension fetches its entire configuration — including a server-assigned unique user token (`my_custom`) and all search engine URLs — from a remote server (`custom-engines.com`). The server fully controls what URL…	1.1
4	Other	high	background.js (line 598)	The extension remotely refreshes its engine definitions and overwrites stored `searchUrl` targets every six hours without requiring an extension update. Because those URLs are later used to redirect user searches, thi…	1.1
5	Remote Code Loading	high	background.js (line 607)	Every 6 hours, the extension fetches updated engine URLs from the remote server and overwrites the locally-stored search URLs (`defaultUrl`, `searchUrl`) without any user notification or integrity verification. This s…	1.1
6	Tracking	high	background.js (line 339)	The server response sets `my_custom` (a unique per-user token) and `linkvDiv` (a div ID used for linkvertise injection). Both values originate entirely from the remote server and are persisted to local storage, then u…	1.1
7	Tracking	high	background.js (line 572)	The extension phones home to the operator's server every 6 hours (or every 30 minutes if the server returns a non-OK response), transmitting the unique user token `my_custom`. This is a persistent heartbeat that allow…	1.1
8	Unauthorized Data Collection	high	background.js (line 643)	Both the uninstall URL and the welcome page URL embed the unique `my_custom` token as the `who=` query parameter, allowing the operator to correlate installs, uninstalls, and user locale with specific tracked identiti…	1.1
9	Other	medium	eventPage.js (line 1)	This content script, injected into every `link-to.net` and `linkvertise.com` page, fires a custom `addon-install` window event, explicitly signaling to the host page's JavaScript that this extension is installed. Link…	1.1
10	Tracking	medium	eventPage.js (line 1)	This content script runs on `link-to.net` and `linkvertise.com`, creates a hidden marker element using a background-provided identifier, and emits a custom `addon-install` event into the page. That behavior looks like…	1.1
11	Tracking	medium	background.js (line 571)	The extension periodically phones home to `https://custom-engines.com/check-in` with a persistent identifier (`my_custom`). Regular beaconing of a unique ID to a remote server is a tracking pattern and is not necessar…	1.1
12	Obfuscation	low	background.js (line 366)	The function named `encryptMessage` performs no encryption whatsoever — it is simply URL-encoding of key-value pairs, identical to standard form serialization. The misleading name suggests deliberate obfuscation of th…	1.1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


custom-engines.com	/create-custom	https://custom-engines.com/create-custom
custom-engines.com	/create-engines	https://custom-engines.com/create-engines
custom-engines.com	/check-in	https://custom-engines.com/check-in
custom-engines.com	/delete/goodbye.php	https://custom-engines.com/delete/goodbye.php?who=
custom-engines.com	/add/start.php	https://custom-engines.com/add/start.php?who=
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
*.link-to.net	/*	https://.link-to.net/
*.linkvertise.com	/*	https://.linkvertise.com/

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

2.8 out of 5 · 9 most recent reviews

Text reviews

Positive

Negative

Scam

Sylvio Ribeiro·14 Jan 2021

جيد

ام

احمد محمد·13 Jan 2021

top

XxX_Killer XxX_·9 Jan 2021

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Custom Engines

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 3 Versions12

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews