Is AuctionGate safe?
AuctionGate uploads your Manheim session cookies and auction visit data, including IP and location, to auctiongate.io.
After you sign in to Manheim, the extension reads all manheim.com cookies and sends them with your auction account ID to auctiongate.io. On lot pages for Manheim, Copart and IAAI it also sends your auction username, buyer number, browser fingerprint, IP address and approximate location, even when you have no AuctionGate login.
Who publishes itauctiongate.io - 9 other listings from the same operator, 6 of them carrying a finding
auctiongate.io - 9 other listings from the same operator, 6 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
9 other listings published from this account, 1k+ users between them. 6 of them carry a finding.
Shared hosts - 17 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
AuctionGate uploads all manheim.com cookies to its server after sign-in
Code analysis shows that once you are signed in to Manheim, the extension reads every manheim.com cookie, including partitioned ones, and posts them to auctiongate.io.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-522
- Source
- Static analysis
You sign in to manheim.com and a page loads in the browser.
The extension reads all manheim.com cookies and sends them to auctiongate.io.
The upload follows a successful user-summary check and a landing-page token match.
Cookie collection and upload
Route target
js/background/urls/getUrls.js auctionAccount: { updateBalance: `${a}/api/v3/auction-account/update-balance`, manheimSaveRiskProfile: `${a}/api/v3/auction-account/add-manheim-auth-hash` },- Cookie jar{"allCookies":[{"name":"...","domain":".manheim.com"}]}
Every manheim.com cookie, which can include session tokens for your account.
- Manheim account IDauction_account_id: manheimId from local storage
Links the cookies to your Manheim account.
- auctiongate.io
Receives the cookie set at /api/v3/auction-account/add-manheim-auth-hash.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
AuctionGate posts your buyer number, IP and location on every lot page
Code analysis shows that on each auction lot page the extension sends your display name, buyer number, IP address and location to auctiongate.io, even when you have no AuctionGate login.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You open an auction lot page while signed in to the auction site.
The extension posts your buyer details, IP and location to auctiongate.io.
Without an AuctionGate login the data goes to an unauthenticated route.
Page-data upload and IP lookup
IP lookup endpoints
js/background/utils/getIpInfo.jsasync function createIpInfoRequest() { const e = [ "https://json.geoiplookup.io/", "http://ip-api.com/json" ], t = e.map((e => fetch(e)));Route targets
js/background/urls/getUrls.js logPageDataNotAuthOnStartUrl: `${a}/api/auction_visited_log_not_auth_reserve`, logPageDataUrl: `${a}/api/v3/log/auction-page-visited`, sendActiveBids: `${a}/api/v3/lot-current-bid/update`, logPageDataNotAuthUrl: `${a}/api/auction_visited_log_not_auth`,- Buyer numberbuyer_number from the auction page
Your auction buyer identity, tied to what you view.
- Display user namedisplay_user_name from the auction page
The name shown on your auction account.
- IP and locationip, isp, city, region, country, lat/long from IP lookup
Your IP address, ISP, city, region, country and coordinates.
- Fingerprintfingerprint from content script
A device fingerprint collected by the page script.
- Lot and VINlot number / VIN
Which vehicle lot you are viewing.
- auctiongate.io
Receives page-visit logs at /api/auction_visited_log_not_auth and the authenticated logPageData route.
- json.geoiplookup.io
- ip-api.com
Queried by the extension for the user's public IP and location.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed AuctionGate contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- ip-api.comwidely used
AuctionGate sends data to ip-api.com. A widely used service: 73 other extensions we have analysed send data here.
- json.geoiplookup.io
AuctionGate sends data to json.geoiplookup.io. 17 other extensions we have analysed send data here.
- auctiongate.io
AuctionGate sends data to auctiongate.io. 10 other extensions we have analysed send data here.
- extmetrics.auctiongate.io
AuctionGate sends data to extmetrics.auctiongate.io. One other extension we have analysed sends data here.