Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: VStat 3 - visit statistics & website traffic

CRITICAL RISKRemoved from Chrome Web Store

VStat 3 - visit statistics & website traffic

ID: bohliiapbjnbphkefjiakajaimlleoma

Could be malicious

Supported Languages

🇺🇸English

🇷🇺Russian

Extension Info & Metadata

Status

Removed

Version

3.114

Size

0.09 MB

Rating

4.1/5

Reviews

119

Users

30,000

Type

Extension

Updated

Aug 5, 2024

Publisher Contextual Analysis

Trusted

Author: https://vstat.infoView Profile
Privacy: Privacy Policy
Help: Help Center
Country: TR
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes
Address: Kızlar Pınarı, Plaj Sk. No:13 Alanya, Antalya 07460 TR
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

35,059

Email Change History

1 change

Sep 9, 2024

Domain changed

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Web Traffic Analysis and Visitors Details SEO plugin. See visitors on icon. See trends. Similar sites and Similarweb info.

Web Traffic Analysis and Visitors Details for domains SEO plugin. Icon show visitors for any site. Charts for the last 6 months. Similar sites and Similaweb info. You can see how many visitors a day have each site. Discover audience data of any website. See detailed reports of websites traffic, audience sources, profile and interests. Collect insights for your marketing and sales teams to improve your marketing and sales funnels. With VStat Chrome extension you can quickly assess your potential client’s digital outreach and assign them into proper client segment. Or you can audit your competitors’ sites, discover their reach and engagement metrics, asses their digital presence. ✓ Check website popularity at a glance, dive into companies’ audience and marketing mix insights in a click. VStat button becomes your surfing assistant. Just don’t forget to activate it. ✓ Use VStat collections to spare countless hours copying, pasting and matching data from a variety of data sources such as rankings, comparisons, directories and such. ✓ Quickly see how your digital assets stack up against competition, tap into areas of growth. ✓ Get insight into your competitors SEO and advertising with report on their organic and paid Google keywords. Give your sales and marketing teams a boost with VStat! You can read privacy policy here https://vstat.info/vstat-pp We hope you will enjoy VStat and would love to hear from you via the chat or [email protected] ❤️ https://vstat.info ❤️

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

No change in user count

Compared to 3 months ago

5 versions released in this period

Rating Count

Total: 99 ratings

Average Rating

Current: 4.38 / 5.0-0.13

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High6

Medium1

Low0

Versions scanned

Showing 1 of 36 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
3.106 Code review	9

Extension Version	Code Review Findings
3.106	9

Files with findings

8 distinct paths — top paths by unique finding count:

scripts/icon/viewIcon.js2
scripts/icon/tracking.js1
scripts/parser/background.js1
scripts/parser/methods/getJobs.js1
scripts/parser/methods/headlessRequest.js1
scripts/parser/methods/offscreen/contentScript.js1
scripts/parser/methods/offscreen/index.js1
scripts/parser/methods/sendResponseToServer.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	scripts/parser/methods/sendResponseToServer.js (line 21)scripts/parser/methods/sendResponseToServer.js (line 21)	The exfiltration endpoint URL is fully server-controlled: getResponseUrl() reads a value the server can push at any time (setResponseUrl is called in getJobs.js with whatever the API returns), supports template-variab…	3.106
2	Remote Code Loading	critical	scripts/parser/methods/getJobs.js (line 11)	The extension polls vstat.info on a chrome.alarms schedule to receive 'jobs' (domain names) and dynamic configuration (request cadence, exfiltration URL). The user's browser is then used to fetch those server-supplied…	3.106
3	Data Exfiltration	high	scripts/parser/methods/offscreen/contentScript.js (line 1)scripts/parser/methods/offscreen/contentScript.js (line 1)	Content script (injected on <all_urls>, all_frames:true) exfiltrates the entire iframe document HTML back to the background on message. There is no origin check on event.source/event.origin, so any framed page on any …	3.106
4	Network Interception	high	scripts/parser/methods/headlessRequest.js (line 32)scripts/parser/methods/headlessRequest.js (line 32)	An offscreen document is spawned to load attacker-supplied URLs inside an iframe so the response DOM (including any cookies/auth state for those domains) can be scraped. Combined with getJobs, this bypasses normal bro…	3.106
5	Network Interception	high	scripts/parser/methods/offscreen/index.js (line 1)scripts/parser/methods/offscreen/index.js (line 1)	Offscreen page accepts any URL passed in via runtime message and loads it into an iframe, then postMessages to it with wildcard target '*'. Coupled with the content script that responds with the full HTML, this is a g…	3.106
6	Remote Code Loading	high	scripts/parser/background.js (line 57)	A persistent alarm-driven loop continuously polls the operator for new scraping jobs and re-arms itself with server-controlled cadence values. This is C2-style command-and-control polling in a productivity extension: …	3.106
7	Tracking	high	scripts/icon/viewIcon.js (line 226)	On every tab update/activation, the hostname of the user's current page is sent to vstat.info via fetch(`${serverName}/api/getVisits/${domain}`) (line 107) and the visit is also reported to a Yandex Metrica tracking g…	3.106
8	Unauthorized Data Collection	high	scripts/icon/viewIcon.js (line 107)	Every domain the user navigates to is reported to vstat.info even if the user never opens the popup or interacts with the extension. The extension claims to display visit statistics, but the side effect is a continuou…	3.106
9	Tracking	medium	scripts/icon/tracking.js (line 5)	User activity is reported to a Yandex Metrica tag loaded inside an offscreen iframe (vstat.info/src/tag.html#<json>) every time a tab updates or the popup is opened. Routing analytics through an offscreen-iframe load …	3.106

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


vstat.info	-	https://vstat.info
vstat.info	/settings	https://vstat.info/settings
addon.similartech.com	/addons/a/0.11.4/chrome/75.0.3770.143/discover	https://addon.similartech.com/addons/a/0.11.4/chrome/75.0.3770.143/discover?url=
data.similarweb.com	/api/v1/data	https://data.similarweb.com/api/v1/data?domain=
www.sitesimilar.net	-	https://www.sitesimilar.net/
fonts.gstatic.com	/s/ptsans/v11/jizaRExUiTo99u79D0aExdGM.woff2	https://fonts.gstatic.com/s/ptsans/v11/jizaRExUiTo99u79D0aExdGM.woff2
fonts.gstatic.com	/s/ptsans/v11/jizfRExUiTo99u79B_mh0OqtLQ0Z.woff2	https://fonts.gstatic.com/s/ptsans/v11/jizfRExUiTo99u79B_mh0OqtLQ0Z.woff2
fonts.googleapis.com	/css	https://fonts.googleapis.com/css?family=Roboto:300,400,500&display=swap&subset=cyrillic
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

3.2 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

No data unless you pay. Waste of time.

Fahim R·4 May 2025

Great Experience

Shafqat Ahmad·4 Feb 2025

it is very slow.

android girl90·4 Dec 2024

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

VStat 3 - visit statistics & website traffic

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Email Change History

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 36 Versions9

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating