Horoscope Search

AI Security Review

Evidence context: threat category browser hijack; evidence quality strong.

Browser Hijacker: Search Redirect to Monetized Domain

This extension exhibits clear browser hijacking behavior through search engine redirection. The finding XIOC-URL-https://www.blpsearch.com/search?source=ea_ext_yhs_1984_horoscopesearch&pc=EAHS&form=HS0001&q= reveals a search URL template with tracking parameters (source, pc, form). This pattern matches known browser hijacker extensions that intercept user searches and redirect them to monetized search portals rather than the user's configured search engine.

The extension also includes uninstall tracking via XIOC-URL-https://www.blpsearch.com/uninstall/', which is a hallmark of unwanted browser extensions designed to measure retention and optimize monetization. The presence of XIOC-URL-https://www.blpsearch.com/search* confirms dynamic URL template construction for search redirection.

Publisher Anonymity

The developer is listed as [email protected], a generic email address with no identifiable company name. Combined with the extension's vague description ("Systematic search interface with coordinated celestial projections"), this indicates a publisher operating without transparency. Legitimate extensions from known companies include proper developer attribution.

False Positive Filtering

Several IoC findings are benign garbage from the XIOC extractor: XIOC-DOMAIN-data.data, XIOC-DOMAIN-sign.name, XIOC-DOMAIN-e.target.id, XIOC-DOMAIN-storagekeys.date, and XIOC-DOMAIN-this.userparams.pub are JavaScript property access chains misread as domains. The finding XIOC-URL-https://clients2.google.com/service/update2/crx is Chrome's legitimate update endpoint. The XIOC-URL-http://www.w3.org/1999/02/22-rdf-syntax-ns# is a standard W3C RDF namespace. These should not influence the verdict.

Counterargument: No Malware Signatures

A skeptic might argue that zero malware signatures and zero obfuscation findings mean this extension is safe. This reasoning is flawed. Browser hijacking is unwanted behavior by design, not malware in the traditional sense. The extension's primary function IS the hijacking—redirecting searches to blpsearch.com with tracking. The 28 code-smell findings are noise from generic JavaScript patterns and do not indicate malicious capability. The threat is the intentional search redirection, not hidden payloads.

Conclusion

This is a confirmed browser hijacker. The extension's core functionality redirects user searches to an external monetized search engine with tracking parameters, published anonymously without legitimate company attribution. Users installing this extension will lose control over their search behavior.

Key Reasons

• Search URL template redirects to blpsearch.com with tracking parameters
• Uninstall tracking endpoint indicates PUP behavior
• Anonymous publisher ([email protected]) with no company attribution
• Extension description is nonsensical marketing language
• Zero malware signatures does not negate hijacking behavior

False Positive Considerations

• Property access chains misread as domains (data.data, e.target.id, etc.)
• Google update endpoint (clients2.google.com)
• W3C RDF namespace URL
• Code-smell findings from generic JavaScript patterns

Reviewed 2026-04-28; recommended action: takedown request; model confidence 85%.