Is INTERALEX safe?
INTERALEX uploads all manheim.com cookies and Copart/IAAI login usernames to auctiongate.io.
After you log into Manheim, the extension reads every manheim.com cookie, including session and partitioned cookies, and sends them to auctiongate.io. For users not signed in to AuctionGate, it also sends Copart and IAAI login usernames with IP address, ISP and location. It additionally logs auction page visits and bids with IP geolocation, and routes manheim.com traffic through a vendor proxy.
Who publishes itauctiongate.io - 9 other listings from the same operator, 6 of them carrying a finding
auctiongate.io - 9 other listings from the same operator, 6 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
9 other listings published from this account, 11k+ users between them. 6 of them carry a finding.
Shared hosts - 20 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Copart and IAAI usernames are sent with your IP and location to auctiongate.io
Code analysis shows Copart or IAAI login usernames are POSTed to auctiongate.io with IP address, ISP and geolocation when the user is not signed in to AuctionGate.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You sign in at Copart or IAAI without being signed in to AuctionGate.
The extension posts the username you typed, with your IP and location, to auctiongate.io.
Code analysis only; this was not observed at runtime.
Username capture and upload
Same logic, names restored
js/background/utils/guestLoginControl.js// 1. On a login POST to copart.com/processLogin or login.iaai.com/Identity, keep the typed usernamecurrentGuestDTO = { userName: body.username /* copart */ || formData["Input.Email"][0] /* iaai */, host };// 2. On the 302 login-success response, if the user is NOT signed in to AuctionGate (is_auth falsy):const ipInfo = await getIPInfo(); // json.geoiplookup.io / ip-api.comconst payload = { event: "Guest user auth", host, user_agent, platform, user_ip, user_isp, user_city, user_country, user_region, latitude, longitude, app_user_name: currentGuestDTO.userName, last_app_user_name, last_app_user_company_id, last_app_user_id, last_login_date};// 3. Sent only when last_app_user_id is set (a prior AuctionGate login was recorded)POST auctiongate.io/api/v1/auction-auth-log // multipart FormData, plus api_token- Login usernameapp_user_name: jsmith@example.com
The username or email you typed into the Copart or IAAI login form.
- IP addressuser_ip: 203.0.113.42
Your public IP address as returned by a geolocation lookup.
- ISP and locationuser_isp: Example Broadband; latitude: 51.5072
Your provider, city, region, country and coordinates.
- Browser and platformplatform: Windows
Your user agent string and operating system platform.
- auctiongate.io
Receives the login record at /api/v1/auction-auth-log.
- json.geoiplookup.io
Queried from the extension to resolve IP, ISP and location.
- ip-api.com
Fallback geolocation lookup used by the same routine.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Manheim cookies are uploaded to auctiongate.io after you log in to Manheim
Code analysis shows every manheim.com cookie, including HttpOnly and partitioned ones, is POSTed to auctiongate.io once a Manheim login is detected, under a field named a risk profile.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-522
- Source
- Static analysis
You log in to Manheim in a browser with this extension and an AuctionGate session.
The extension reads all your manheim.com cookies and posts them to auctiongate.io.
Code analysis only; this was not observed at runtime.
Cookie read and upload path
Same logic, names restored
js/background/manheim/manheimLoginControl.jsasync function saveValidAuthCookies({URI}) { const allCookies = [ ...await chrome.cookies.getAll({ domain: "manheim.com" }), // every cookie, no name filter ...await getManheimPartitionedCookies() // plus partitioned cookies ]; const res = await sendManheimCookies({ allCookies, URI }); if (res?.responseStatus && !(res.responseStatus >= 400)) { await setLocalstorage({ isManheimServerAuthCookiesValid: true }); }}// POST body sent to URI.auctionAccount.manheimSaveRiskProfile// = auctiongate.io/api/v3/auction-account/add-manheim-auth-hash{ auction_account_id: <manheimId from local storage>, pingone_risk_device_profile: JSON.stringify({ allCookies }), pingone_risk_browser_profile: "none"}- Cookie set{"allCookies":[{"name":"...","domain":".manheim.com","httpOnly":true}]}
Every cookie for manheim.com, including session and auth cookies, with no name filter.
- Manheim account IDauction_account_id: manheimId from local storage
Links the uploaded cookies to your Manheim account record.
- Browser profilenone
A fixed filler value beside the cookie field.
- auctiongate.io
Receives the cookies at /api/v3/auction-account/add-manheim-auth-hash.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed INTERALEX contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- ip-api.comwidely used
INTERALEX sends data to ip-api.com. A widely used service: 73 other extensions we have analysed send data here.
- json.geoiplookup.io
INTERALEX sends data to json.geoiplookup.io. 17 other extensions we have analysed send data here.
- auctiongate.io
INTERALEX sends data to auctiongate.io. 10 other extensions we have analysed send data here.