Is DealsUpp WA Sender - Bulk Messages Automation Tool safe?

Medium risk

DealsUpp wa message sender sends WhatsApp page details to Google Analytics and link URLs to preview services.

On WhatsApp Web pages, the extension injects a helper library that sends the page URL, referrer, title, screen details, language, and session events to Google Analytics. When a campaign message contains a web link, the helper's default link-preview flow sends that URL to third-party preview servers before the WhatsApp message is sent.

francisrodney81v2.1.9Chrome Web Store
45Risk
Who publishes it

francisrodney81 - 1 other listing from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
francisrodney81

Same store account

1 other listing published from this account, 8k+ users between them. 1 of them carries a finding.

ChatGPT File Uploader & Conversation Saver8k+Medium

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

extension-center.com
Also called by 3 other listings: WA Bulk Message Sender Extension, WA Group Number Exporter, DealsUpp - Contact Saver for WA

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Campaign message URLs are sent to third-party link-preview services

Starting a WhatsApp campaign with a link sends it through the WhatsApp page script with previews on.

The first URL is forwarded to third-party services, including cobrancas.uppermesh.com.br:8000 and wajsapi.titanchat.com.br, before sending.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You start a campaign send flow with message text that contains a web link.

The extension did this

The extension sends the campaign message through WhatsApp with link previews enabled, causing the first URL to be forwarded to third-party preview services.

Captured request
GEThttps://cobrancas.uppermesh.com.br:8000/v1/link-preview/fetch-data.png?url=
Fields in the request
  • Campaign message URL
    https://example.com/campaign (illustrative)

    The link in your outgoing campaign message can reveal the destination you are sharing before WhatsApp sends the message.

Observation

Dynamic analysis confirmed the send path from the popup campaign flow to the WhatsApp page script and the link-preview fetch path to third-party preview hosts.

Where it sends data

Destinations our analysis observed DealsUpp WA Sender - Bulk Messages Automation Tool contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • analytics.google.comwidely used

    DealsUpp WA Sender - Bulk Messages Automation Tool sends data to analytics.google.com. A widely used service: 25 other extensions we have analysed send data here.

  • wajsapi.titanchat.com.br

    DealsUpp WA Sender - Bulk Messages Automation Tool sends data to wajsapi.titanchat.com.br. 12 other extensions we have analysed send data here.

  • wppc-linkpreview.cloudtrix.com.br

    DealsUpp WA Sender - Bulk Messages Automation Tool sends data to wppc-linkpreview.cloudtrix.com.br. 12 other extensions we have analysed send data here.

  • cobrancas.uppermesh.com.br

    DealsUpp WA Sender - Bulk Messages Automation Tool sends data to cobrancas.uppermesh.com.br. 8 other extensions we have analysed send data here.

Updated 30 September 2026aemhfpfbocllfcbpiofnmacfmjdmoecf