Is Pro Sender - Free Bulk WhatsApp Sender safe?
Pro Sender transmits your WhatsApp phone number and Google account email to its vendor backend on every WhatsApp Web visit.
Each time you open WhatsApp Web, the extension reads your phone number from localStorage and your signed-in Google email via the Chrome identity API, then sends both to aws-api-fp.averion.in. The server can return arbitrary HTML that is injected directly into the WhatsApp Web page, and your phone number is also included as a label in every Google Analytics event sent to the vendor's GA property, linking your identity to behavioral telemetry.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
WhatsApp number and Google email sent to vendor on every visit
On WhatsApp Web, this extension reads your WhatsApp number from the page and your Chrome profile's Google email, then sends both to averion.in as a 'plan lookup' on every visit.
A planted number reached aws-api-fp.averion.in verbatim.
You open WhatsApp Web while the extension is installed.
The extension reads your WhatsApp phone number and your Chrome-profile Google email and sends both to the developer's server.
The lookup runs automatically as part of a 'fetch plan details' routine every time the page loads.
| Field | Value | Why it matters | |
|---|---|---|---|
Your WhatsApp phone number | 5559990001 | Your own number, taken from WhatsApp Web's stored session. It directly identifies you and your messaging account. | |
Your Google account email | jane.doe@gmail.com | The Google account email signed into your Chrome profile, via the browser identity API. Ties your WhatsApp number to your identity. |
Reading your number, then requesting your email and sending both
GET https://aws-api-fp.averion.in/ps/fp?phone=<your WhatsApp number>&email=<your Google email>
- aws-api-fp.averion.in
Developer-operated backend (averion.in) that receives your WhatsApp phone number and Google account email on every WhatsApp Web visit.
Watches outbound traffic / proxy logs for the plan-lookup request that carries your WhatsApp number and Google email to averion.in.
#!/usr/bin/env bash
# Run your browser through a logging proxy (e.g. mitmproxy) while visiting
# web.whatsapp.com, then grep the flow log for the leak.
# mitmdump -w whatsapp.flows
# Then:
INPUT="${1:-whatsapp.flows}"
strings "$INPUT" | grep -E 'aws-api-fp\.averion\.in/ps/fp\?phone=' \
&& echo 'LEAK: WhatsApp number (and possibly Google email) sent to averion.in' \
|| echo 'No plan-lookup exfil request seen in this capture.'- 1Capture browser traffic to a flow/HAR file while opening WhatsApp Web.
- 2Run: ./detect-prosender-exfil.sh <capture-file>.
- 3Any matching line shows your phone (and email) in the query string sent to averion.in.
Vendor server can change the extension's keys and behavior at runtime
On each WhatsApp Web visit, the extension fetches a config file from aws-api-gc.averion.in and applies it live: GA credentials, DOM selectors, pricing shown, and a re-injection flag can all change post-install without a Store update.
You open WhatsApp Web with the extension installed.
The extension downloads a config file from the developer's server and applies it to its running code.
The config can change analytics credentials, the DOM selectors used on WhatsApp Web, pricing, and a flag that re-injects the script.
| Field | Value | Why it matters | |
|---|---|---|---|
Analytics credentials (GA_CONFIG) | { MEASUREMENT_ID: "G-XXXXXXXX", API_SECRET: "..." } | Replaces the Google Analytics measurement ID and API secret the extension reports to, redirecting where your telemetry is sent. | |
Page selectors | { chat_list: "div[data-testid='chat-list']" } | Swaps the CSS/DOM selectors the extension uses to find and read elements on the WhatsApp Web page. | |
Pricing (PRICING_DATA) | { premium: { price: "$9.99" } } | Overrides the pricing displayed to you inside the extension UI. | |
Runtime flags (RUNTIME_CONFIG) | { reloadInject: true, useOldInjectMethod: false } | Setting reloadInject=true makes the extension dispatch a PROS::init event to re-initialize / re-inject its script into the page. |
Fetching the remote config and applying it to live variables
GET https://aws-api-gc.averion.in/ps/gc?operation=get-all-config-data // response.data[] keyed by name -> GA_CONFIG / DOCUMENT_ELEMENT_SELECTORS / PRICING_DATA / RUNTIME_CONFIG
- aws-api-gc.averion.in
Developer-operated config server. Returns JSON applied to the extension's live analytics credentials, DOM selectors, pricing, and script-injection flags on each WhatsApp Web visit.
Your WhatsApp number is attached to every Google Analytics event
Every button click on WhatsApp Web sends a GA event via the developer's own account.
The event 'label' is built from your WhatsApp number plus plan type, tying telemetry to your number.
A planted number appeared verbatim in GA labels.
You click any button or take any tracked action in the extension on WhatsApp Web.
The extension sends a Google Analytics event whose 'label' field contains your WhatsApp phone number.
The label is built from your number plus plan type and is attached to every tracked event.
| Field | Value | Why it matters | |
|---|---|---|---|
Your WhatsApp number (in 'label') | 5559990001 Expired | Your phone number is concatenated into the analytics label, tying every recorded action to you personally instead of an anonymous ID. | |
Your WhatsApp number (in 'track') | 5559990001 | The number is also carried in a separate 'track' parameter on the event. | |
Plan type | FreeTrial | Your subscription tier, used to segment you alongside the number. |
| Content-Type | text/plain |
{
"client_id": "a1b2c3d4-e5f6-7890-abcd-ef0123456789",
"events": [
{
"name": "whatsapp_visit",
"params": {
"label": "5559990001 Expired",
"track": "5559990001",
"type": "event",
"session_id": "1718457600000",
"engagement_time_msec": "100"
}
}
]
}The phone number is built into the analytics label and posted to GA
POST https://www.google-analytics.com/mp/collect?measurement_id=G-Z5RKTJRHLN&api_secret=<redacted>
{ "events": [ { "name": "whatsapp_visit", "params": { "label": "<your number> <plan>", "track": "<your number>" } } ] }- www.google-analytics.com
Google Analytics (GA4 Measurement Protocol), measurement ID G-Z5RKTJRHLN. Receives event payloads whose label and track fields contain your WhatsApp phone number.