Is Mitridat safe?
Mitridat sends auction-site login names, bids and page visits, with IP location, to auctiongate.io.
On Copart and IAAI, the extension reads the username typed into the login form and, when the visitor is not signed in to the extension but a previous user exists on the browser, sends it to auctiongate.io with IP, location and the prior user identity. It also posts auction page visits and bids with user IDs and IP/geo data, and uploads Manheim session cookies for the shared auction account. Manheim traffic is routed through a proxy supplied by the vendor's API.
Who publishes itauctiongate.io - 9 other listings from the same operator, 6 of them carrying a finding
auctiongate.io - 9 other listings from the same operator, 6 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
9 other listings published from this account, 11k+ users between them. 6 of them carry a finding.
Shared hosts - 19 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Auction login usernames are sent with IP and location to auctiongate.io
Code analysis shows typed Copart and IAAI login usernames are posted to auctiongate.io with IP, location and prior extension user details when you are signed out of the extension.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You sign in to Copart or IAAI while signed out of the extension.
The extension sends your typed username, IP and location to auctiongate.io.
- Typed login usernamejsmith@example.com
The username or email you entered on the auction site's own login form.
- IP address203.0.113.24
Your public IP, looked up from third-party geolocation services.
- Location
City, region, country, ISP, latitude and longitude of your connection.
- Previous extension user
Name, company ID, user ID and last login date of the last extension account.
- Browser and platformMozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/126.0.0.0
Your user agent string and operating system platform.
Capture of the typed username and the upload
Plain reading: login POST body is stored, then sent on redirect
js/background/utils/guestLoginControl.js// onBeforeRequest on copart.com/processLogin/* and login.iaai.com/Identity/*// copart: JSON.parse(body).username ; iaai: formData['Input.Email'][0]// -> storage.currentGuestDTO = { userName, host }// onHeadersReceived 302 to /loginSuccess.html or /connect/authorize// if (!is_auth) {// ipInfo = await getIPInfo()// record = { app_user_name: userName, user_ip, user_isp, user_city, user_country,// user_region, latitude, longitude, user_agent, platform,// last_app_user_name, last_app_user_company_id, last_app_user_id, last_login_date }// if (record.last_app_user_id) POST FormData(api_token + record) -> URI.createGuestUser// }- auctiongate.io
Receives the auction-auth-log POST with username, IP, location and prior user identity.
- json.geoiplookup.io
IP and geolocation lookup used to fill the location fields.
- ip-api.com
Second IP and geolocation lookup, fetched over plain HTTP.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed Mitridat contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- ip-api.comwidely used
Mitridat sends data to ip-api.com. A widely used service: 73 other extensions we have analysed send data here.
- json.geoiplookup.io
Mitridat sends data to json.geoiplookup.io. 17 other extensions we have analysed send data here.
- auctiongate.io
Mitridat sends data to auctiongate.io. 10 other extensions we have analysed send data here.