Is Mystique safe?
Mystique is medium risk. Opening Mystique features or searching its new-tab page requests mloeri.com/track/evt.php with feature name, extension ID, and stored install time/cohort. The request sends credentials, so mloeri.com cookies go too. No live path fired.…
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Feature events sent to mloeri.com with cookies
Opening Mystique features or searching its new-tab page requests mloeri.com/track/evt.php with feature name, extension ID, and stored install time/cohort.
The request sends credentials, so mloeri.com cookies go too.
No live path fired.
You open or use a Mystique feature in the new-tab page.
The code names forecast, quick links, top sites, options, news, notepad, to-do list, welcome, and search interactions.
Mystique prepares a tracking request to mloeri.com for that interaction.
The request includes the feature name and value, and one path also adds stored install and cohort values.
| Field | Value | Why it matters | |
|---|---|---|---|
Extension ID | edcdolejdklgjkjinjknidifilkpnmgn | Lets the destination associate the event with this installed Chrome extension. | |
Feature name | forecast | Shows which part of the extension you used. | |
Feature value | open | Adds detail about the interaction, such as opening a panel or clicking an option. | |
Install time | 1713139200 (illustrative) | Can help connect multiple events back to the same extension install over time. | |
Cohort | default (illustrative) | Can group your install with a stored rollout or experiment value. | |
mloeri.com cookies | visitor_id=8f14e45fceea167a5a36dedd4bea2543 (illustrative) | If your browser has cookies for mloeri.com, the credentialed request path includes them with the event. |
Shipped code that builds the mloeri.com event requests
function trackFeature(feature, value) {
var url = 'https://mloeri.com/track/evt.php?extid='+chrome.runtime.id+'&feature='+encodeURIComponent(feature)+'&value='+encodeURIComponent(value);
var xhr = new XMLHttpRequest();
xhr.withCredentials = true;
xhr.open('GET', url, true);
xhr.send('');
}function trackFeature (feature, value) {
chrome.storage.sync.get(['cohort', 'install_time'], function(data) {
var url = 'https://mloeri.com/track/evt.php?extid='+chrome.runtime.id+'&feature='+encodeURIComponent(feature)+'&value='+encodeURIComponent(value);
if (data['install_time']) {
url += '&install_time='+data['install_time']
}
if (data['cohort']) {
url += '&cohort='+encodeURIComponent(data['cohort']);
}
fetch(url);
});
}
chrome.runtime.onMessage.addListener(
function(request, sender, sendResponse) {
if (request.feature) {
trackFeature(request.feature, request.value);
}
}
);Examples of feature interactions that call trackFeature
$(document).on('click', function (e) {
if ($(e.target).closest('#weather').length) {
if ($("#forecast").is(':hidden')) {
trackFeature('forecast', 'open');
}
$("#forecast").slideToggle();
} else if (!$(e.target).closest('#forecast').length) {
$('#forecast').slideUp();
}
});
$(document).on('click', function (e) {
if ($(e.target).closest('#menu').length) {
if ($("#menuTools").is(':hidden')) {
trackFeature('quick_links', 'open');
}
$("#menuTools").slideToggle();
} else if (!$(e.target).closest('#menuTools').length) {
$('#menuTools').slideUp();
}
});
$(document).on('click', function (e) {
if ($(e.target).closest('#topSitesIcon').length) {
if ($("#topSitesMenu").is(':hidden')) {
trackFeature('top_sites', 'open');
}
$("#topSitesMenu").slideToggle();
} else if (!$(e.target).closest('#topSitesMenu').length) {
$('#topSitesMenu').slideUp();
}
});- mloeri.com
Receives feature interaction events at /track/evt.php, including feature/value parameters and stored install values when present.
Searches route through webresult.info before the engine
Submitting a search in Mystique redirects to webresult.info/search.php before the chosen provider.
The redirect carries the typed term, extension ID, and stored install time/cohort.
No live request recorded; testing never typed in the box.
You submit a search from Mystique's search box.
The handler runs when you press Enter in the search field or click the search button.
Mystique redirects your browser through webresult.info with the search query in the URL.
The same function also sends a search feature event to the extension background script.
| Field | Value | Why it matters | |
|---|---|---|---|
Search query | weather tomorrow (illustrative) | The words you type into Mystique's search box are sent in the redirect URL. | |
Extension ID | edcdolejdklgjkjinjknidifilkpnmgn | Identifies the Chrome extension that generated the search redirect. | |
Search provider marker | p=yhs&u=mystique | Indicates the provider path selected by the extension for the redirect. | |
Install time | 1713139200 (illustrative) | Can connect multiple searches back to the same extension install over time. | |
Cohort | default (illustrative) | Can group your searches with a stored rollout or experiment value. |
Shipped code that redirects searches through webresult.info
// Searching
$('#searchTextbox').focus();
$('#searchTextbox').keypress(function (e) {
if (e.keyCode == 13) {
runSearch();
}
});
$('#searchClose').click(function () {
$('.searchEngine').hide();
$('#searchResults').hide();
});
$('#searchButton').click(function () {
runSearch();
});
function runSearch() {
var searchTerm = document.getElementById('searchTextbox').value;
chrome.runtime.sendMessage({feature: "search", value: searchTerm});
chrome.storage.sync.get(['cohort', 'install_time'], function(data) {
var url = 'https://webresult.info/search.php?p=yhs&extid='+chrome.runtime.id+'&u=mystique&q=' + encodeURIComponent(searchTerm);
if (data['install_time']) {
url += '&install_time='+data['install_time']
}
if (data['cohort']) {
url += '&cohort='+encodeURIComponent(data['cohort']);
}
window.location = url;
});
}- webresult.info
Receives search redirects at /search.php with the typed query, extension ID, provider marker, and stored install values when present.