How to find a ref-following chrome extension?

Question

Google Chrome

I found that when I go to certain sites, something re-enters them using referral links.
I am almost completely sure that this is the result of some kind of extension. For example, switching to digitalocean, I am transferred to
1. extads.net (the link is completely blocked by the toaster)
2. Immediately to https://referer.pro/?http://46.105.123.75/url/?id=...
I looked at the history, there was also the same IP address, and it was directly written about the referral. I'm trying to catch an extension that does this. extads.net is registered in Russia (reg.ru) and on April 16. That is, they began to earn money in this way recently, it is not surprising that there is no information about this on the Internet. I tried to search through notepad ++ to find the extension, but all such queries did not help, probably, if this is an extension, it is obfuscated for references to make it harder to calculate. Any ideas other than how to disable extensions one by one? There are quite a few of them. And the transition on the ref is triggered once in a certain period only.

Answer 1

you can turn it on one by one
in incognito mode
, it’s obvious that there is a suspicion of a certain limited list

Answer 2

We look where the extensions are, I have this profile\Default\Extensions\
by searching through files, for example, using TotalComander we are looking for files containing the first transition node extads.net
With a high probability this will help to find malware, but alas, ext has the ability to connect js from an external site.

Answer 3

Had the same problem as it turned out to be the Skyload extension. On aliexpress when I went to the product page .. went to https://referer.pro and then to the main ali ..

Answer 4

Most likely this extension https://chrome.google.com/webstore/detail/360-inte...