Is الحوت الأزرق safe?
The extension sends Copart and IAAI login usernames, with IP and location details, to auctiongate.io.
On Copart and IAAI sign-in, the extension reads the login username and posts it with IP address, ISP, city, region and coordinates to auctiongate.io. It also uploads Manheim session cookies for the vendor-managed shared auction account, and logs auction lot page visits with buyer number, URL and a browser fingerprint. Locally, it lists installed extensions and detects DevTools to log out or disable itself.
Who publishes itauctiongate.io - 9 other listings from the same operator, 6 of them carrying a finding
auctiongate.io - 9 other listings from the same operator, 6 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
9 other listings published from this account, 11k+ users between them. 6 of them carry a finding.
Shared hosts - 20 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Copart and IAAI login usernames sent with location data to auctiongate.io
Code analysis shows the extension reads the username typed into Copart or IAAI login and, after sign-in, sends it with IP, ISP and location to auctiongate.io.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
The user logs in to copart.com or login.iaai.com directly, after having used the extension account before.
The extension sends the typed username with IP, ISP and location fields to auctiongate.io.
The record also carries the stored extension account name, company id and user id.
Username capture and the outbound record
Destination defined in js/background/urls/getUrls.js
createGuestUser = `${base}/api/v1/auction-auth-log`- app_user_namebuyer@example.com (illustrative)
The username or email typed into the Copart or IAAI login form.
- user_ip203.0.113.24 (illustrative)
Your public IP address from a third-party lookup.
- user_ispExample Telecom (illustrative)
Your internet provider as reported by the lookup.
- city, region, lat/longAustin, TX, 30.27, -97.74 (illustrative)
Approximate location from the IP lookup.
- last_app_user_*stored account values
Name, company id and user id of the last extension account signed in.
- auctiongate.io
Receives the login record at /api/v1/auction-auth-log.
- json.geoiplookup.io
IP, ISP and location lookup used to fill the record.
- ip-api.com
Second IP and location lookup, requested over plain HTTP.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed الحوت الأزرق contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- ip-api.comwidely used
الحوت الأزرق sends data to ip-api.com. A widely used service: 73 other extensions we have analysed send data here.
- json.geoiplookup.io
الحوت الأزرق sends data to json.geoiplookup.io. 17 other extensions we have analysed send data here.
- auctiongate.io
الحوت الأزرق sends data to auctiongate.io. 10 other extensions we have analysed send data here.