Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: 搜个券

CRITICAL RISKRemoved from Chrome Web Store

搜个券

ID: dochpllpidpeeejofcmjpdmdcbhmdbfh

Could be malicious

Supported Languages

🇨🇳Chinese (Simplified)

Extension Info & Metadata

Status

Removed

Version

7.23.72

Size

0.09 MB

Rating

0.0/5

Reviews

Users

90,000

Type

Extension

Updated

Feb 1, 2024

Publisher Contextual Analysis

Trusted

Author: sundanqcView Profile
Privacy: Privacy Policy
Country: 中国
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Address: 浙桥路277号2号楼上海 201200 中国

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

1,020,081

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

搜个券，在您逛天猫淘宝网站时，为您搜索获取隐藏券，购买更便宜!

打开淘宝天猫购物网站，必须要登录该网站，可以查看是否有优惠券，通过优惠券购买为用户带来返利。如果有优惠券会在商品详情页的内嵌中显示出来，还会显示一个同款推荐。如果商家未提供优惠券则不显示内嵌的内容。

User Growth

Showing data from Jan 01, 2022 to Mar 29, 2024

Versions

-10%(-10,000 users)

Compared to 3 months ago

3 versions released in this period

Rating Count

Total: 0 ratings

Average Rating

Current: 0.00 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High4

Medium1

Low0

Versions scanned

Showing 1 of 4 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
7.21.53 Code review	8

Extension Version	Code Review Findings
7.21.53	8

Files with findings

3 distinct paths — top paths by unique finding count:

js/background.js5
js/content.js2
rules.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	js/content.js (line 107)	On every first visit of the day to any domain, the content script sends the full window.location.href (URL-encoded) via the `geth` handler, which the background forwards to http://se.sogequan.com/coupon/logc. This is …	7.21.53
2	Network Interception	critical	js/background.js (line 634)	A chrome.tabs.onUpdated listener (q) inspects every navigation and, if the destination host matches entries in s.ul (URL list) or s.al (domain regex list) fetched from the remote server se.sogequan.com, calls A() to s…	7.21.53
3	Remote Code Loading	critical	js/background.js (line 230)	The extension fetches /coupon/send.json from se.sogequan.com, decodes it with the custom obfuscator, and directly installs the returned objects as dynamic declarativeNetRequest rules via updateDynamicRules. The server…	7.21.53
4	Data Exfiltration	high	js/content.js (line 50)	Content script injects remotely-configured iframes into arbitrary pages, with the iframe's src coming from the decoded `fset`/hotsell response (t.u) and the current page URL appended as `up=<encoded href>`. This leaks…	7.21.53
5	Obfuscation	high	js/background.js (line 3)	Custom de-obfuscation routine: splits the remote response into even/odd character streams, reverses each, concatenates, pads, and base64 decodes. It is used to decode all command/config payloads (rules, affiliate list…	7.21.53
6	Privilege Escalation	high	js/background.js (line 601)	The background message handler exposes an `insert` RPC that calls chrome.scripting.executeScript with a caller-supplied `files` array, and a `net` RPC that proxies arbitrary ajax through O.ajax on behalf of content sc…	7.21.53
7	Tracking	high	js/background.js (line 260)	A 32-hex-char persistent device ID is generated on first run and stored in chrome.storage.local, then attached as `u` to every telemetry/fetch request. The b() beacon POSTs this UID alongside channel/version metadata …	7.21.53
8	Network Interception	medium	rules.json (line 1)	A static declarativeNetRequest rule forces `Access-Control-Allow-Origin: *` on every response from se.sogequan.com. This lets scripts on any origin read the server's responses cross-origin, which aids covert data chan…	7.21.53

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


s.taobao.com	/search	https://s.taobao.com/search?app=imgsearch&tfsid=
uland.taobao.com	/coupon/edetail	https://uland.taobao.com/coupon/edetail?dx=1&activityId=
s.taobao.com	/search	https://s.taobao.com/search?app=i2i&rec_type=1&uniqpid=&nid=
http:	-	http://\|https://\|//
se.sogequan.com	/he/coupon/p/	https://se.sogequan.com/he/coupon/p/
item.taobao.com	/item.htm	https://item.taobao.com/item.htm?id=
se.sogequan.com	/he/goodsCoupon/itemId/	https://se.sogequan.com/he/goodsCoupon/itemId/
se.sogequan.com	/he/getCoupon/itemId/	https://se.sogequan.com/he/getCoupon/itemId/
domain.com	/path/to/somewhere/	http://domain.com:8080/path/to/somewhere/?foo=bar#hash
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

搜个券

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 4 Versions8

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating