Am I Being Pwned?
Get started

Is Pro Sender - Free Bulk WhatsApp Sender safe?

Medium risk

Pro Sender transmits your WhatsApp phone number and Google account email to its vendor backend on every WhatsApp Web visit.

Each time you open WhatsApp Web, the extension reads your phone number from localStorage and your signed-in Google email via the Chrome identity API, then sends both to aws-api-fp.averion.in. The server can return arbitrary HTML that is injected directly into the WhatsApp Web page, and your phone number is also included as a label in every Google Analytics event sent to the vendor's GA property, linking your identity to behavioral telemetry.

Ocube Itv1.3.7Chrome Web Store
51Risk
Who publishes it

Ocube It - no other listings under this identity, 3 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Ocube It
Website
prosender.tech/contact

Shared hosts - 3 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

aws-api-fp.averion.in
Also called by 1 other listing: Moneybelfort
aws-api-gc.averion.in
Also called by 1 other listing: Moneybelfort
prosender.tech
Also called by 4 other listings, including Moneybelfort, qqt-cat-%E5%85%8D%E8%B4%B9%E7%BE%A4%E5%8F%91-whatsapp-%E6%B6%88%E6%81%AF

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

WhatsApp number and Google email sent to vendor on every visit

MediumunwantedCWE-359Dynamic sandbox

On WhatsApp Web, this extension reads your WhatsApp number from the page and your Chrome profile's Google email, then sends both to averion.in as a 'plan lookup' on every visit.

What actually happens

You did this

You open WhatsApp Web while the extension is installed.

The extension did this

The extension reads your WhatsApp phone number and your Chrome-profile Google email and sends both to the developer's server.

The lookup runs automatically as part of a 'fetch plan details' routine every time the page loads.

What gets sent to aws-api-fp.averion.in

  • Your WhatsApp phone number
    5559990001

    Your own number, taken from WhatsApp Web's stored session. It directly identifies you and your messaging account.

  • Your Google account email
    jane.doe@gmail.com

    The Google account email signed into your Chrome profile, via the browser identity API. Ties your WhatsApp number to your identity.

Captured request

GEThttps://aws-api-fp.averion.in/ps/fp?phone=5559990001&email=jane.doe@gmail.com

Returns the account's plan/subscription details as JSON. During dynamic analysis a phone number seeded into WhatsApp Web local storage appeared verbatim in the phone= parameter of this request to averion.in.

The code that does this

Reading your number, then requesting your email and sending both

Readable version

Resolved request URL

GET https://aws-api-fp.averion.in/ps/fp?phone=<your WhatsApp number>&email=<your Google email>

Where the data ends up

    • aws-api-fp.averion.in

    Developer-operated backend (averion.in) that receives your WhatsApp phone number and Google account email on every WhatsApp Web visit.

Check if you're affected

Watches outbound traffic / proxy logs for the plan-lookup request that carries your WhatsApp number and Google email to averion.in.

Requires
  • A traffic capture tool (mitmproxy/Charles/Fiddler) or proxy logs
  • bash + GNU grep
detect-prosender-exfil.sh · sh
#!/usr/bin/env bash# Run your browser through a logging proxy (e.g. mitmproxy) while visiting# web.whatsapp.com, then grep the flow log for the leak.#   mitmdump -w whatsapp.flows# Then:INPUT="${1:-whatsapp.flows}"strings "$INPUT" | grep -E 'aws-api-fp\.averion\.in/ps/fp\?phone=' \  && echo 'LEAK: WhatsApp number (and possibly Google email) sent to averion.in' \  || echo 'No plan-lookup exfil request seen in this capture.'
How to run it
  1. 1Capture browser traffic to a flow/HAR file while opening WhatsApp Web.
  2. 2Run: ./detect-prosender-exfil.sh <capture-file>.
  3. 3Any matching line shows your phone (and email) in the query string sent to averion.in.

Vendor server can change the extension's keys and behavior at runtime

MediumunwantedCWE-829Dynamic sandbox

On each WhatsApp Web visit, the extension fetches a config file from aws-api-gc.averion.in and applies it live: GA credentials, DOM selectors, pricing shown, and a re-injection flag can all change post-install without a Store update.

What actually happens

You did this

You open WhatsApp Web with the extension installed.

The extension did this

The extension downloads a config file from the developer's server and applies it to its running code.

The config can change analytics credentials, the DOM selectors used on WhatsApp Web, pricing, and a flag that re-injects the script.

Runtime values the remote config can overwrite

  • Analytics credentials (GA_CONFIG)
    { MEASUREMENT_ID: "G-XXXXXXXX", API_SECRET: "..." }

    Replaces the Google Analytics measurement ID and API secret the extension reports to, redirecting where your telemetry is sent.

  • Page selectors
    { chat_list: "div[data-testid='chat-list']" }

    Swaps the CSS/DOM selectors the extension uses to find and read elements on the WhatsApp Web page.

  • Pricing (PRICING_DATA)
    { premium: { price: "$9.99" } }

    Overrides the pricing displayed to you inside the extension UI.

  • Runtime flags (RUNTIME_CONFIG)
    { reloadInject: true, useOldInjectMethod: false }

    Setting reloadInject=true makes the extension dispatch a PROS::init event to re-initialize / re-inject its script into the page.

Captured request

GEThttps://aws-api-gc.averion.in/ps/gc?operation=get-all-config-data

Returns JSON ({"data":[{name, data}, ...]}) that is mapped by name into GA_CONFIG, DOCUMENT_ELEMENT_SELECTORS, PRICING_DATA, RUNTIME_CONFIG and others. During dynamic analysis this request fired automatically on first navigation to web.whatsapp.com; the captured response body was empty, but the live server-controlled config channel and its handling were confirmed.

The code that does this

Fetching the remote config and applying it to live variables

Readable version

Resolved config request

GET https://aws-api-gc.averion.in/ps/gc?operation=get-all-config-data// response.data[] keyed by name -> GA_CONFIG / DOCUMENT_ELEMENT_SELECTORS / PRICING_DATA / RUNTIME_CONFIG

Source of the runtime configuration

    • aws-api-gc.averion.in

    Developer-operated config server. Returns JSON applied to the extension's live analytics credentials, DOM selectors, pricing, and script-injection flags on each WhatsApp Web visit.

Your WhatsApp number is attached to every Google Analytics event

LowunwantedCWE-359Dynamic sandbox

Every button click on WhatsApp Web sends a GA event via the developer's own account.

What actually happens

You did this

You click any button or take any tracked action in the extension on WhatsApp Web.

The extension did this

The extension sends a Google Analytics event whose 'label' field contains your WhatsApp phone number.

The label is built from your number plus plan type and is attached to every tracked event.

What rides along in each analytics event

  • Your WhatsApp number (in 'label')
    5559990001 Expired

    Your phone number is concatenated into the analytics label, tying every recorded action to you personally instead of an anonymous ID.

  • Your WhatsApp number (in 'track')
    5559990001

    The number is also carried in a separate 'track' parameter on the event.

  • Plan type
    FreeTrial

    Your subscription tier, used to segment you alongside the number.

Captured request

POSThttps://www.google-analytics.com/mp/collect?measurement_id=G-Z5RKTJRHLN&api_secret=<redacted>

Google Analytics Measurement Protocol ingest. During dynamic analysis the seeded number 5559990001 appeared in params.label ('5559990001 Expired', '5559990001 FreeTrial') and params.track ('5559990001'); pre-seed events showed label 'Expired' with no digits, isolating the phone-in-label behavior.

Headers
Content-Type
text/plain
Body
{  "client_id": "a1b2c3d4-e5f6-7890-abcd-ef0123456789",  "events": [    {      "name": "whatsapp_visit",      "params": {        "label": "5559990001 Expired",        "track": "5559990001",        "type": "event",        "session_id": "1718457600000",        "engagement_time_msec": "100"      }    }  ]}

The code that does this

The phone number is built into the analytics label and posted to GA

Readable version

Resolved analytics request

POST https://www.google-analytics.com/mp/collect?measurement_id=G-Z5RKTJRHLN&api_secret=<redacted>{ "events": [ { "name": "whatsapp_visit", "params": { "label": "<your number> <plan>", "track": "<your number>" } } ] }

Where the analytics data goes

    • www.google-analytics.com

    Google Analytics (GA4 Measurement Protocol), measurement ID G-Z5RKTJRHLN. Receives event payloads whose label and track fields contain your WhatsApp phone number.

Where it sends data

Destinations our analysis observed Pro Sender - Free Bulk WhatsApp Sender contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.google-analytics.comwidely used

    Pro Sender - Free Bulk WhatsApp Sender sends data to www.google-analytics.com. A widely used service: 388 other extensions we have analyzed send data here.

  • sheetdb.io

    Pro Sender - Free Bulk WhatsApp Sender sends data to sheetdb.io. 5 other extensions we have analyzed send data here.

  • aws-api-fp.averion.in

    Pro Sender - Free Bulk WhatsApp Sender sends data to aws-api-fp.averion.in. One other extension we have analyzed sends data here.

  • aws-api-gc.averion.in

    Pro Sender - Free Bulk WhatsApp Sender sends data to aws-api-gc.averion.in. No other extension we have analyzed sends data here.

Updated 2 November 2026nnaaobbghcgbefbkhinikgdolfkgnhfj