Is FlashSale AutoBuy safe?
FlashSale AutoBuy sends shopping product URLs and popup tab details with stored location fields to buydekhke.com and unscart.com.
When shopping pages on Amazon India, Flipkart, or TataCliq load, its content script sends the current product URL to data.unscart.com to fetch price graph data. Opening the popup requests geolocation, stores location fields, and posts the active tab URL, title, price, email, latitude, and longitude to www.buydekhke.com.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
FlashSale AutoBuy sends visited Amazon and Flipkart pages to data.unscart.com
FlashSale AutoBuy injects a price-tracking script into Amazon India, Flipkart, and TataCliq pages.
On load, before the widget draws and without a click, it sends the page URL to data.unscart.com, apart from the listed alert feature.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open an Amazon India, Flipkart, or TataCliq product page covered by the extension.
The extension's price-tracking script sends the full URL of that page to data.unscart.com before showing any price information.
- Page URL you're viewinghttps://www.amazon.in/dp/B0BDJ3S1MZ
Identifies the exact product page you're browsing, tying that Amazon or Flipkart activity to a third-party service.
- Integration key (userid parameter)userid=desitricks
A fixed value identifying FlashSale AutoBuy's integration with data.unscart.com; it does not vary per user.
Returns pricing history data used to draw the on-page price graph; the response body was not captured in this test.
- data.unscart.com
Receives the URL of every Amazon India, Flipkart, or TataCliq product page you view through the extension's price-tracking script.
This request fires automatically as soon as the content script loads, whether or not the price-graph widget is ever shown or clicked. The Chrome Web Store listing describes FlashSale AutoBuy as a flash-sale purchase automation tool for specific phone models; data.unscart.com is a separate price-tracking service not mentioned in that description.
Where it sends data
Destinations our analysis observed FlashSale contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- data.unscart.com
FlashSale sends data to data.unscart.com. No other extension we have analysed sends data here.
- www.buydekhke.com
FlashSale sends data to www.buydekhke.com. No other extension we have analysed sends data here.