Who makes Bancarios Profit?

Bancarios Profit is published by luanandradeti10.

What servers does Bancarios Profit send data to?

Our analysis observed Bancarios Profit sending data to leodobancarios.com, livedrop.ludraapi.site and ludraapi.site.

Is Bancarios Profit safe?

Q: Is Bancarios Profit safe?

Bancarios Profit is medium risk. Using the injected giveaway action on CSGO.net refill history sends the invoice ID with your profile ID to ludraapi.site. The extension also reads refill-history content and stored/socket account state to link invoices to your profile.

Medium risk

Bancarios Profit sends CSGO.net item, roll, and invoice details to ludraapi.site services.

Bancarios Profit watches CSGO.net pages for market item grids, case and upgrade results, and refill-history invoice rows. It posts item names and prices, roll identifiers with the CSGO.net user ID, and invoice identifiers with the user ID to ludraapi.site endpoints, and embeds a leodobancarios.com giveaway form for refill-history actions.

luanandradeti10v6.2.0Chrome Web Store

45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

CSGO.net invoice IDs are sent to Ludra API with the user's profile ID.

Using the injected giveaway action on CSGO.net refill history sends the invoice ID with your profile ID to ludraapi.site.

The extension also reads refill-history content and stored/socket account state to link invoices to your profile.

Severity: Medium unwanted
Type: Unexpected
CWE: CWE-359
Source: Dynamic sandbox

What actually happens

You did this

The user clicks the injected giveaway action from CSGO.net refill history.

The extension did this

The extension sends the selected refill-history invoice ID and CSGO.net user ID to ludraapi.site.

Captured request

POSThttps://ludraapi.site/invoice/leodobancarios

Fields in the request

Refill-history page content
Invoice 123456789 (illustrative)
Used to locate coupon and invoice entries that can be linked to the giveaway action.
CSGO.net account state
76561198000000000 (illustrative)
Connects the invoice record to a specific CSGO.net profile ID.

Where it sends data

Destinations our analysis observed Bancarios Profit contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

leodobancarios.com
Bancarios Profit sends data to leodobancarios.com. No other extension we have analysed sends data here.
livedrop.ludraapi.site
Bancarios Profit sends data to livedrop.ludraapi.site. No other extension we have analysed sends data here.
ludraapi.site
Bancarios Profit sends data to ludraapi.site. No other extension we have analysed sends data here.