Is SEO Search Simulator by Nightwatch safe?

Medium risk

Nightwatch SEO Search Simulator is medium risk. Opening the SEO Search Simulator popup contacts ipapi.co, a third-party geolocation service, to get your country; your IP is sent as part of the request. The result is cached in localStorage so it fires once, with no disclosure at install.

Nightwatchv1.3.1Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Simulator sends your IP to third-party geolocation service on first launch

Opening the SEO Search Simulator popup contacts ipapi.co, a third-party geolocation service, to get your country; your IP is sent as part of the request.

The result is cached in localStorage so it fires once, with no disclosure at install.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open the SEO Search Simulator popup for the first time.

The extension checks localStorage for a cached 'last-country' value and finds none.

The extension did this

The extension immediately fetches https://ipapi.co/json/ to detect your country from your IP.

Your IP address is transmitted to ipapi.co as the TCP source address with no user notification.

Captured request
GEThttps://ipapi.co/json/

JSON object: {"ip":"203.0.113.42","city":"London","region":"England","country_code":"GB","country_name":"United Kingdom","latitude":51.5074,"longitude":-0.1278,...}

Headers
Origin
chrome-extension://edfjfgjklednkencfhnokmkajbgfhpon
The code that does this

Country auto-detection function (chunk-cc7f0988.js, line 6820)

Readable version
async function detectCountryFromIp { const cached = localStorage.getItem('last-country'); if (cached) { state.country = JSON.parse(cached); return; } const findCountry = code => state.countries.find(c => c.code.toLowerCase === code.toLowerCase) || null; try { const response = await fetch('https://ipapi.co/json/'); if (!response.ok) throw new Error(`Network response was not ok: ${response.statusText}`); const data = await response.json; const matched = findCountry(data.country_code) || null; state.country = matched || findCountry('us'); localStorage.setItem('last-country', JSON.stringify(state.country)); } catch { state.country = findCountry('us'); }}
External host receiving the user's IP
    • ipapi.co

    IP geolocation API. Receives the user's public IP as TCP source address, returns country, city, region, coordinates. Operated by Kloudend Inc., independent of Nightwatch.

What's stored on your device

After the first lookup, the resolved country is cached here. Subsequent popup opens skip the ipapi.co call entirely.

Location
localStorage key 'last-country'
Contents
{  "code": "GB",  "name": "United Kingdom",  "language": "en"}

What it can do

Permissions this extension asks for, as declared in version 1.3.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on g.cn

    *://*.g.cn/*

  • Read and change your data on google.ae

    *://*.google.ae/*

  • Read and change your data on google.al

    *://*.google.al/*

  • Read and change your data on google.am

    *://*.google.am/*

  • Read and change your data on google.as

    *://*.google.as/*

  • Read and change your data on google.az

    *://*.google.az/*

  • Read and change your data on google.ba

    *://*.google.ba/*

  • Read and change your data on google.be

    *://*.google.be/*

  • Read and change your data on google.bf

    *://*.google.bf/*

  • Read and change your data on google.bg

    *://*.google.bg/*

  • Read and change your data on google.bi

    *://*.google.bi/*

  • Read and change your data on google.bj

    *://*.google.bj/*

  • Read and change your data on google.bs

    *://*.google.bs/*

  • Read and change your data on google.by

    *://*.google.by/*

  • Read and change your data on google.ca

    *://*.google.ca/*

  • Read and change your data on google.cc

    *://*.google.cc/*

  • Read and change your data on google.cd

    *://*.google.cd/*

  • Read and change your data on google.cf

    *://*.google.cf/*

  • Read and change your data on google.cg

    *://*.google.cg/*

  • Read and change your data on google.ch

    *://*.google.ch/*

  • Read and change your data on google.ci

    *://*.google.ci/*

  • Read and change your data on google.cl

    *://*.google.cl/*

  • Read and change your data on google.cm

    *://*.google.cm/*

  • Read and change your data on google.co.ao

    *://*.google.co.ao/*

  • Read and change your data on google.co.bw

    *://*.google.co.bw/*

  • Read and change your data on google.co.ck

    *://*.google.co.ck/*

  • Read and change your data on google.co.cr

    *://*.google.co.cr/*

  • Read and change your data on google.co.id

    *://*.google.co.id/*

  • Read and change your data on google.co.il

    *://*.google.co.il/*

  • Read and change your data on google.co.in

    *://*.google.co.in/*

  • Read and change your data on google.co.jp

    *://*.google.co.jp/*

  • Read and change your data on google.co.ke

    *://*.google.co.ke/*

  • Read and change your data on google.co.kr

    *://*.google.co.kr/*

  • Read and change your data on google.co.ls

    *://*.google.co.ls/*

  • Read and change your data on google.co.ma

    *://*.google.co.ma/*

  • Read and change your data on google.co.mz

    *://*.google.co.mz/*

  • Read and change your data on google.co.nz

    *://*.google.co.nz/*

  • Read and change your data on google.co.th

    *://*.google.co.th/*

  • Read and change your data on google.co.tz

    *://*.google.co.tz/*

  • Read and change your data on google.co.ug

    *://*.google.co.ug/*

  • Read and change your data on google.co.uk

    *://*.google.co.uk/*

  • Read and change your data on google.co.uz

    *://*.google.co.uz/*

  • Read and change your data on google.co.ve

    *://*.google.co.ve/*

  • Read and change your data on google.co.vi

    *://*.google.co.vi/*

  • Read and change your data on google.co.za

    *://*.google.co.za/*

  • Read and change your data on google.co.zm

    *://*.google.co.zm/*

  • Read and change your data on google.co.zw

    *://*.google.co.zw/*

  • Read and change your data on google.com

    *://*.google.com/*

  • Read and change your data on google.com.ai

    *://*.google.com.ai/*

  • Read and change your data on google.com.ar

    *://*.google.com.ar/*

  • Read and change your data on google.com.au

    *://*.google.com.au/*

  • Read and change your data on google.com.bd

    *://*.google.com.bd/*

  • Read and change your data on google.com.bh

    *://*.google.com.bh/*

  • Read and change your data on google.com.bn

    *://*.google.com.bn/*

  • Read and change your data on google.com.br

    *://*.google.com.br/*

  • Read and change your data on google.com.bz

    *://*.google.com.bz/*

  • Read and change your data on google.com.co

    *://*.google.com.co/*

  • Read and change your data on google.com.cu

    *://*.google.com.cu/*

  • Read and change your data on google.com.cy

    *://*.google.com.cy/*

  • Read and change your data on google.com.do

    *://*.google.com.do/*

  • Read and change your data on google.com.ec

    *://*.google.com.ec/*

  • Read and change your data on google.com.eg

    *://*.google.com.eg/*

  • Read and change your data on google.com.et

    *://*.google.com.et/*

  • Read and change your data on google.com.fj

    *://*.google.com.fj/*

  • Read and change your data on google.com.gh

    *://*.google.com.gh/*

  • Read and change your data on google.com.gi

    *://*.google.com.gi/*

  • Read and change your data on google.com.gt

    *://*.google.com.gt/*

  • Read and change your data on google.com.hk

    *://*.google.com.hk/*

  • Read and change your data on google.com.jm

    *://*.google.com.jm/*

  • Read and change your data on google.com.kh

    *://*.google.com.kh/*

  • Read and change your data on google.com.kw

    *://*.google.com.kw/*

  • Read and change your data on google.com.lb

    *://*.google.com.lb/*

  • Read and change your data on google.com.ly

    *://*.google.com.ly/*

  • Read and change your data on google.com.mm

    *://*.google.com.mm/*

  • Read and change your data on google.com.mt

    *://*.google.com.mt/*

  • Read and change your data on google.com.mx

    *://*.google.com.mx/*

  • Read and change your data on google.com.my

    *://*.google.com.my/*

  • Read and change your data on google.com.na

    *://*.google.com.na/*

  • Read and change your data on google.com.nf

    *://*.google.com.nf/*

  • Read and change your data on google.com.ng

    *://*.google.com.ng/*

  • Read and change your data on google.com.ni

    *://*.google.com.ni/*

  • Read and change your data on google.com.np

    *://*.google.com.np/*

  • Read and change your data on google.com.om

    *://*.google.com.om/*

  • Read and change your data on google.com.pa

    *://*.google.com.pa/*

  • Read and change your data on google.com.pe

    *://*.google.com.pe/*

  • Read and change your data on google.com.pg

    *://*.google.com.pg/*

  • Read and change your data on google.com.ph

    *://*.google.com.ph/*

  • Read and change your data on google.com.pk

    *://*.google.com.pk/*

  • Read and change your data on google.com.pr

    *://*.google.com.pr/*

  • Read and change your data on google.com.py

    *://*.google.com.py/*

  • Read and change your data on google.com.qa

    *://*.google.com.qa/*

  • Read and change your data on google.com.sa

    *://*.google.com.sa/*

  • Read and change your data on google.com.sb

    *://*.google.com.sb/*

  • Read and change your data on google.com.sg

    *://*.google.com.sg/*

  • Read and change your data on google.com.sl

    *://*.google.com.sl/*

  • Read and change your data on google.com.sv

    *://*.google.com.sv/*

  • Read and change your data on google.com.tj

    *://*.google.com.tj/*

  • Read and change your data on google.com.tr

    *://*.google.com.tr/*

  • Read and change your data on google.com.tw

    *://*.google.com.tw/*

  • Read and change your data on google.com.ua

    *://*.google.com.ua/*

  • Read and change your data on google.com.uy

    *://*.google.com.uy/*

  • Read and change your data on google.com.vc

    *://*.google.com.vc/*

  • Read and change your data on google.com.vn

    *://*.google.com.vn/*

  • Read and change your data on google.cv

    *://*.google.cv/*

  • Read and change your data on google.cz

    *://*.google.cz/*

  • Read and change your data on google.de

    *://*.google.de/*

  • Read and change your data on google.dj

    *://*.google.dj/*

  • Read and change your data on google.dk

    *://*.google.dk/*

  • Read and change your data on google.dm

    *://*.google.dm/*

  • Read and change your data on google.dz

    *://*.google.dz/*

  • Read and change your data on google.ee

    *://*.google.ee/*

  • Read and change your data on google.es

    *://*.google.es/*

  • Read and change your data on google.fi

    *://*.google.fi/*

  • Read and change your data on google.fm

    *://*.google.fm/*

  • Read and change your data on google.fr

    *://*.google.fr/*

  • Read and change your data on google.ga

    *://*.google.ga/*

  • Read and change your data on google.ge

    *://*.google.ge/*

  • Read and change your data on google.gf

    *://*.google.gf/*

  • Read and change your data on google.gl

    *://*.google.gl/*

  • Read and change your data on google.gm

    *://*.google.gm/*

Updated 30 September 2026edfjfgjklednkencfhnokmkajbgfhpon