Subzillo 1.0.17
Steals cookies and tokens
“Track and manage your subscriptionsA powerful, privacy-first extension that automatically detects and extracts your subscription details to…”
Multimodal IP profiling (server + browser side)Attribute breakout injects image onerror
SHA-256aefa35365f67a352a08a463bb0526146bc17e854a39ca5f720bce94aa76193b9
Evidence
1(function(){let e=document.createElement(`link`).relList;if(e&&e.supports&&e.supports(`modulepreload`))return;for(let e of document.querySelectorAll(`link[rel="modulepreload"]`))n(e);new MutationObserver(e=>{for(let t of e)if(t.type===`childList`)for(let e of t.addedNodes)e.tagName===`LINK`&&e.rel===`modulepreload`&&n(e)}).ob …
1:630… function n(e){if(e.ep)return;e.ep=!0;let n=t(e);fetch(e.href,n)}})();function e(e,t){(t==null||t>e.length)&&(t=e.length);for(var n=0,r=Array(t);n<t;n++)r[n]=e[n];return r}function t(e){if(Array.isArray …
15:1384… tTab()})})}var $e={};async function et(){return new Promise(e=>{chrome.storage.local.get([`deviceId`],t=>{if(t.deviceId)e(t.deviceId);else{let t=crypto.randomUUID();chrome.storage.local.set({deviceId:t},()=>e(t))}})})}async function tt(e){let t=await et(),n={...e,platform:1,deviceId:t,uniqueId:t,pushMode:0},r=await B(`${R}/checkLogin`,{method:`POST`,headers:z(),body:JSON.stringify(n)}),i=await r.json();return{status:r.status,ok:r.ok,data:i}}async function nt(e,t,n,r,i){let a={verifyType:Number(t.loginType),email:t.email||``,phoneNumber:t.phoneNumber||``,countryCode:t.countryCode||``,phoneIsoCode:t.phoneIsoCode||i||`IN`,otp:parseInt(e,10),userId:String(n),verifyMergeType:1},o=await B(`${R}/verifyOtp`,{method:`POST`,headers:z(r),body:JSON.stringify(a)}),s=await o.json();return{status:o.status,ok:o.ok,data:s}}function rt(e){$e=e}function it(){return $e}async function H(e,t){let n={userId:String(e),page:0,filter:{includeFamilyMembers:! …
19:5551… alue:``);let e=P.allCountries.find(e=>e.dialCode===`+91`);try{let t=new AbortController,n=setTimeout(()=>t.abort(),3e3),r=await fetch(`https://ipapi.co/json/`,{signal:t.signal});if(clearTimeout(n),r.ok){let t=await r.json();if(t&&t.country_code){let n=P.allCountries.find(e=>e.isoCode&&e.isoCode.toUpperCase()===t.country_code.toUpperCase());n&&(e=n)}}}catch(e){console.warn(`Could not auto-detect location, using fallback.`,e)}$t(e| …
67:122… h: 100%;">
68 <div style="display: flex; align-items: center; gap: 10px; overflow: hidden;">
69 <img class="country-item-flag" src="${e.countryFlag||``}" alt="" onerror="this.style.display='none'">
70 <span class="country-item-name">${e.countryName||`Unknown`}</span>
71 </div>
72 <span class="country-item-dial">${e.dialCode||``}</span>
73 </div>
74 …
Showing the top 5 files — 7 more files (285 regions) not shown.
No evidence locations were recorded for this file. Raw result