Is imhlnhlb safe?

High risk

imhlnhlb is high risk. DA captured POSTs to api.leadcontact.ai with a fingerprint (fonts, canvas, WebGL, audio, screen, plugins, CPU) plus URL, title, referrer per page. Fires on non-government, non-exchange sites; the fingerprint stays stable across sessions.

75Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

FingerprintJS browser fingerprint transmitted on every page load

DA captured POSTs to api.leadcontact.ai with a fingerprint (fonts, canvas, WebGL, audio, screen, plugins, CPU) plus URL, title, referrer per page.

Fires on non-government, non-exchange sites; the fingerprint stays stable across sessions.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You navigate to any website.

The content script runs at document_idle on all URLs. Government (.gov/.mil) and a hardcoded list of financial exchange domains (nasdaq.com, bloomberg.com, etc.) are excluded.

The extension did this

The extension computes a browser fingerprint and sends it, along with the page URL, title, and referrer, to api.leadcontact.ai.

The POST fires automatically without any user interaction. The fingerprint remains stable across sessions, enabling cross-site re-identification.

02EvidenceNETWORK CAPTURE
Captured request
POSThttps://api.leadcontact.ai/api/website/track?ttype=3
Confirmed via dynamic analysis (content script). CORS preflight OPTIONS requests also observed for wikipedia.org, reddit.com, and linkedin.com.
Headers
Content-Typeapplication/x-www-form-urlencoded
Body
type=3&name=Peer&url=https%3A%2F%2Fwww.amazon.com%2F&referer=&title=Amazon.com%3A+Online+Shopping&full_fingerprint=f02245f7a591f99879f746d98056be8f&simple_fingerprint=2531ee97bfa6fd43885a257296e000eb
03EvidenceFIELD TABLE
Fields sent in every tracking POST
FieldValueWhy it matters
Full browser fingerprint
f02245f7a591f99879f746d98056be8fA stable hash from 30+ attributes: fonts, canvas, WebGL, audio, screen, plugins, CPU count. Stable across sessions and incognito.
Simple browser fingerprint
2531ee97bfa6fd43885a257296e000ebA lighter hash of font preferences, screen frame, resolution, and touch support, used alongside the full fingerprint for device ID.
Full page URL
https://www.amazon.com/s?k=noise+cancelling+headphonesThe complete URL of the page you are visiting, including any query strings that may contain search terms or session tokens.
Referrer URL
https://www.google.com/search?q=headphonesThe URL of the page you navigated from, enabling the service to reconstruct navigation paths across sites.
Page title
Noise Cancelling Headphones - Amazon.comThe <title> of the current page, which often contains product names, article headlines, or search queries.
04EvidenceCODE COMPARE
The code that does this

Tracking call in peer.js, fingerprint collection and POST dispatch

What it actually does
// peer.js lines 1770-1795
async function uo(e) {
  let { name: n, url: t = "", referer: o = "", title: r = "", ttype: l = "1" } = e;
  const a = l;
  // Set url/title/referer from current page context
  if (Ke()) { // service worker context
    t = t || chrome.runtime.getURL("") + "service-worker";
    r = r || "LC Service Worker";
  } else { // content script context
    t = t || document.URL;
    o = o || document.referrer;
    r = r || document.title;
  }
  // Fetch LinkedIn session cookie if available
  if (Je()) re = re || await ue($e, "lc");
  // Compute fingerprints (cached after first call)
  if (!ie) ie = await ao();       // full_fingerprint via FingerprintJS
  if (!ae) ae = await co();       // simple_fingerprint subset
  return fetch(Xe + "/api/website/track?ttype=" + a, {
    method: "POST",
    credentials: "include",
    headers: { "Content-Type": "application/x-www-form-urlencoded", lc: re },
    body: new URLSearchParams({
      type: a, name: n, url: t, referer: o, title: r,
      full_fingerprint: ie,
      simple_fingerprint: ae
    }).toString()
  });
}

// lines 1797-1809: IIFE triggers lo() (which calls uo with ttype=3) on every page load
(function() {
  const e = window.location.hostname.toLowerCase();
  const n = /\.(gov|gob|mil|gouv|admin|gv|go|govt)(\.|$)/i;
  const t = new Set(["nasdaq.com", "bloomberg.com", "swift.com", /* ...120+ domains */]);
  if (!n.test(e) && !t.has(e) && !Array.from(t).some(r => e.endsWith("." + r))) {
    lo({ name: "Peer" }); // fires uo() with ttype=3
  }
})();
05EvidenceTHIRD PARTY LIST
Destination host
  • api.leadcontact.ai

    LeadContact AI platform API. Receives the fingerprint plus page URL, title, referrer on every navigation. leadcontact.ai is the extension's own B2B visitor-ID service.

Updated 10 September 2026imhlnhlbiencamnbpigopiibddajimep