SoloSearch

AI Security Review

Evidence context: threat category browser hijack; evidence quality strong.

SoloSearch exhibits classic browser hijacker behavior through its custom search infrastructure and analytics tracking endpoints. The extension's description explicitly mentions "intelligent redirection" which, combined with the infrastructure findings, indicates search result manipulation.

Browser Hijacking Evidence:

The extension connects to blpsearch.com for search functionality, as shown in multiple IoC findings: XIOC-URL-https://www.blpsearch.com/search* and XIOC-URL-https://blpsearch.com/uninstall?extid=. Custom search domains like blpsearch.com are the primary indicator of browser hijacking—legitimate extensions use established search providers (Google, Bing, DuckDuckGo) rather than proprietary search infrastructure. The uninstall endpoint with extid parameter suggests tracking of extension installations/uninstallations, a common PUP behavior pattern.

Data Exfiltration Evidence:

The extension transmits analytics data to expldata.com/api/events (finding: XIOC-URL-https://www.expldata.com/api/events'). Combined with the network finding NET-FETCH-background-service-worker.js-727 showing active fetch calls in the background service worker, this confirms runtime data transmission to an external analytics service. The domain name expldata.com paired with explorads.com developer email suggests an advertising network infrastructure rather than a legitimate product company.

Publisher Anonymity:

The developer is listed as [email protected]—a generic email address with no company attribution. The extension has 0 users and version 1.0.0, indicating it is newly published with no track record. This anonymity combined with hijacker infrastructure is a strong risk signal.

False Positive Considerations:

Several IoC findings are XIOC extractor garbage: this.userparams.tg, this.userparams.pub, storagekeys.date, and chrome.storage are property access chains misread as domains. The 18 code-smell findings are classified as low severity and per CVEQ guidelines represent noise from standard JavaScript patterns. However, these false positives do not negate the legitimate findings against blpsearch.com and expldata.com.

Counterargument Assessment:

A skeptic might argue that the absence of malware signatures and obfuscation indicates benign behavior. However, browser hijackers rarely use traditional malware techniques—they operate through legitimate-looking functionality (custom search, analytics) that violates user trust and browser security expectations. The combination of custom search infrastructure, analytics tracking, and anonymous publishing is sufficient to classify this as a confirmed risk regardless of malware signature absence. The extension's behavior matches known PUP/browser hijacker patterns where harm comes from unwanted search redirection and data collection rather than traditional malware payloads.

Key Reasons

• Custom search domain blpsearch.com indicates browser hijacking infrastructure
• Analytics endpoint expldata.com/api/events transmits user data
• Anonymous publisher [email protected] with no company attribution
• Zero user count and version 1.0.0 indicate untested new extension
• Network fetch calls in background-service-worker.js confirm runtime data transmission

False Positive Considerations

• Property access chains misread as domains (this.userparams.tg, storagekeys.date)
• Code-smell findings classified as low severity noise
• XIOC extractor false positives on standard JavaScript patterns

Reviewed 2026-04-27; recommended action: monitor; model confidence 85%.