Is IndiaMART Lead Manager – Export Buyer & Inquiry Leads safe?
IndiaMART Lead Manager sends completed buyer lead exports to scrappertool.com.
After a user runs a scrape on seller.indiamart.com, the extension fetches lead lists and contact details, stores normalized records locally, and offers a CSV download. When the scrape finishes, it posts the completed record set, including buyer names, phone numbers, emails, addresses, company details, GST IDs, websites, products of interest, and query dates, to www.scrappertool.com/api/v1/user/activity.
Who publishes itScrapper Tool - 2 other listings from the same operator, none carrying a finding
Scrapper Tool - 2 other listings from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
2 other listings published from this account, 5k+ users between them, none of them carrying a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Completed IndiaMART leads are sent to scrappertool.com
Exporting IndiaMART leads makes the extension collect lead lists and details from the seller site, store records locally, and send the dataset to scrappertool.com, including buyer names, phones, emails, company, GST, and query dates.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You start an IndiaMART lead export and later stop or complete it.
The popup labels the stop flow as Stop & Download CSV.
The extension downloads the CSV and also posts the finished lead records to scrappertool.com.
The upload happens after local storage is marked with scrape_status set to Finished.
Observed during dynamic analysis after the completed scrape path ran.
- Content-Type
- application/x-www-form-urlencoded
- Buyer nameAmit Sharma (illustrative)
Identifies the buyer or contact who reached you through IndiaMART.
- Phone number+91 98765 43210 (illustrative)
Gives the activity endpoint a direct phone contact for the buyer.
- Email addressamit.sharma@example.in (illustrative)
Gives the activity endpoint a direct email contact for the buyer.
- Company nameSharma Industrial Supplies (illustrative)
Links the buyer record to the organization that contacted you.
- Postal addressAndheri East, Mumbai, Maharashtra 400069, India (illustrative)
Adds location and delivery context for the buyer or company.
- GST value27ABCDE1234F1Z5 (illustrative)
Can identify an Indian business tax registration associated with the buyer record.
- Websitehttps://www.sharmaindustrial.example (illustrative)
Adds a web presence or company URL to the exported contact record.
- Products of interestindustrial fasteners, machine parts (illustrative)
Shows what products the buyer viewed or asked you about.
- Query date2026-07-12 (illustrative)
Shows when the buyer activity or inquiry happened.
The content script collects IndiaMART leads and normalizes contact fields
Readable equivalent of lead-list and contact-detail requests
js/content.jsreturn e.next = 10, d.postJson(location.origin + "/lmsreact/getFilteredContacts", { q: "*", source: "", loc: "", lead_txn: "", product: "", mcat: "", page: i, datestart: r, dateend: o, contact_label: "", label_color: "", filter_by: "Activity Date", starred: "", unread: "", bulk: "", untouched: "", order: "", whatsApp: "", sort_by: "Activity Date", hiddenfilter: "", requireblock: "", label_id: "", selectedFilters: "", timeFilterName: "Custom Date", is_archive: 0});return e.next = 2, d.postJson(location.origin + "/lmsreact/getContactDetail", { glid: String(r)});Readable equivalent of the normalizer and local storage update
js/content.jsnormalizeApiLeadRecord: function(e, n) { var r = n && n.ContactDetail && "object" === t(n.ContactDetail) ? n.ContactDetail : {}, o = Object.assign({}, e || {}, n || {}, r), i = d.pickFirst(o, ["contacts_address", "address", "Address", "contact_address", "company_address", "buyer_address", "city_state", "CONTACT_ADDRESS", "full_address"]), a = {}; if (i) try { a = v(i) } catch (t) { a = {} } var s = d.pickFirst(o, ["contact_city", "city", "City"]) || a.city || "", c = d.pickFirst(o, ["contact_state", "state", "State"]) || a.state || "", u = d.pickFirst(o, ["contact_pincode", "pincode", "zip", "zipcode", "Zip Code"]) || a.pincode || "", l = d.pickFirst(o, ["country_name", "glusr_usr_countryname", "country", "Country"]) || a.country || ""; return i || (i = [d.pickFirst(o, ["contact_locality"]), d.pickFirst(o, ["contact_district"]), s, c, u, l].filter((function(t) { return t })).join(", ")), { address: i, business_type: d.pickFirst(o, ["business_type", "Business Type", "biz_type", "glusr_usr_custtype_name"]), c_name: d.pickFirst(o, ["contacts_company", "company", "company_name", "sender_company", "organization", "c_name", "Company"]), city: s, country: l, email: d.pickFirst(o, ["contacts_email1", "contacts_email2", "email", "Email", "email_id", "EMAIL", "contact_email", "sender_email"]), phone: d.pickFirst(o, ["contacts_mobile1", "contacts_phone1", "phone", "mobile", "mobile_no", "contact_number", "sender_mobile", "contacts_mobile", "MOBILE", "mobile_number"]), pincode: u, buyer_name: d.pickFirst(o, ["contacts_name", "contact_name", "name", "buyer_name", "sender_name", "query_sender_name", "person_name"]), product_title: d.pickFirst(o, ["contact_last_product", "mcat_name", "product_title", "product", "product_name", "subject", "query_product", "enq_product_name"]), products_of_interest: d.pickFirst(o, ["mcat_name", "products_of_interest", "Products Of Interest", "product_interest", "interest"]), query_date: d.normalizeApiDate(d.pickFirst(o, ["latest_txn_date", "last_contact_date", "contacts_add_date", "query_date", "activity_date", "last_activity_date", "date", "created_date", "mod_date", "last_message_date"])), state: c, website: d.pickFirst(o, ["contacts_website", "website", "Website", "url", "company_url"]) }}k = d.normalizeApiLeadRecord(b, w), 0 == d.checkDuplicatesData(s, k, c) && (s.push(k), p = parseInt(p) + 1, _ = parseInt(_) + 1), t.next = 60, d.setLocalStore({ scrapped_items_arr: s, tsc: p, cpc: _, scrape_item_index: y + 1});The background worker posts finished records to the activity API
Readable equivalent of stopAutoBotProcess
js/background.jsstopAutoBotProcess: function(e) { chrome.storage.local.get(function() { var t = a(r().mark((function t(n) { var a, o; return r().wrap((function(t) { for (;;) switch (t.prev = t.next) { case 0: return n.scrapped_items_arr.length > 0 ? (u.downloadCSV(), "next_profile_not_found" == e ? (a = { title: "Downloading started", msg: "Successfully Data scrapped and downloading CSV file has been started." }, u.create_notifications(a)) : "trial_version_expire" == e ? (a = { title: "Upgrade Required", msg: 'IndiaMart Lead Manager process has been stopped!! because the "Free Trial Version" Only Scrap Up to 10 Data. After 10 Data it will stop automatically.' }, u.create_notifications(a)) : "register_required" == e ? (a = { title: "Process Stopped", msg: "IndiaMart Lead Manager process has been stopped and downloading CSV file has been started. You need to register for more scrape data." }, u.create_notifications(a)) : "user_not_approved" == e ? (a = { title: "Process Stopped", msg: "IndiaMart Lead Manager process has been stopped and downloading CSV file has been started. You are not registered or your account is not approved for more scrape data." }, u.create_notifications(a)) : "manual_stop" == e ? (a = { title: "Process Stopped", msg: "IndiaMart Lead Manager process has been stopped and downloading CSV file has been started." }, u.create_notifications(a)) : "api_detail_error" == e && (a = { title: "Process Stopped", msg: "IndiaMart detail API failed. Collected data is being downloaded as CSV." }, u.create_notifications(a))) : (a = { title: "Process Stopped", msg: "No data found! IndiaMart Lead Manager process has been stopped." }, u.create_notifications(a)), l(n.active_search_tab_id, { command: "removeBlocker" }), n.scrape_status = "Finished", n.active_search_tab_id = 0, chrome.storage.local.set({ active_search_tab_id: n.active_search_tab_id, scrape_status: n.scrape_status }), o = "", null != n.edit_id && (o = n.edit_id), t.next = 9, u.checkXClientAndServerIdToServer(); case 9: return t.next = 11, u.saveUserActivityToDB(e, o); case 11: l("", { command: "updateScrapeState" }); case 12: case "end": return t.stop() } }), t) }))); return function(e) { return t.apply(this, arguments) } }())}Readable equivalent of saveUserActivityToDB
js/background.jssaveUserActivityToDB: function(t, n) { return new Promise(function() { var c = a(r().mark((function a(c, s) { var i, u, l, p, d; return r().wrap((function(r) { for (;;) switch (r.prev = r.next) { case 0: return r.next = 2, chrome.storage.local.get(); case 2: null != (i = r.sent).X_Client_Id && null != i.server_user_id && ((u = new Headers).append("X-Client-Id", i.X_Client_Id), u.append("X-Server-Id", i.server_user_id), u.append("x-Product-id", "11"), u.append("x-Product-Version", o), u.append("x-csrf-token", i.token_id || ""), u.append("Content-Type", "application/x-www-form-urlencoded"), (l = new URLSearchParams).append("scrape_status", i.scrape_status), l.append("cpc", i.cpc), l.append("tsc", i.tsc), l.append("scrape_limit", i.scrape_limit), l.append("scrape_limit_type", i.scrape_limit_type), l.append("scrape_type", i.scrape_type), l.append("search_query", i.Keywords_input), l.append("stop_reason", t), l.append("edit_id", n), "Finished" == i.scrape_status && (p = i.scrapped_items_arr || [], d = (d = (d = JSON.stringify(p)).replace(/\\n/g, "\\n").replace(/\\'/g, "\\'").replace(/\\"/g, '\\"').replace(/\\&/g, "\\&").replace(/\\r/g, "\\r").replace(/\\t/g, "\\t").replace(/\\b/g, "\\b").replace(/\\f/g, "\\f")).replace(/[\u0000-\u0019]+/g, ""), l.append("items", d)), fetch(e.base_api_url + e.save_activity_api_url, { method: "POST", body: l, headers: u, redirect: "follow" }).then((function(e) { return e.json() })).then((function(e) { return c(e) })).catch((function(e) { return c({}) }))); case 4: case "end": return r.stop() } }), a) }))); return function(e, t) { return c.apply(this, arguments) } }())}- www.scrappertool.com
Receives activity API POSTs containing scrape metadata and, when scrape_status is Finished, an items form field with JSON-serialized lead records.
Where it sends data
Destinations our analysis observed IndiaMART Lead Manager – Export Buyer & Inquiry Leads contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.scrappertool.com
IndiaMART Lead Manager – Export Buyer & Inquiry Leads sends data to www.scrappertool.com. One other extension we have analysed sends data here.