In the addon config.js contains a list of 950 sites, these are loaded dynamically at runtime and passed to a function in index.js that makes a call to hxxps://config.extaddon.site/ff/href/?id= to stuff cookies in the users browser to steal affiliate sales and otherwise enrich the developer without informing the user.
