Is Rapidcatch eBay auction sniper safe?

Medium risk

Rapidcatch is medium risk. Each cookie sync POST to rapidcatch.com now carries a fingerprint field with browser version, CPU architecture and platform details. Observed during dynamic analysis on v3.33; v3.28 sent cookies only.

rapidcatchv3.31Chrome Web Store
45Risk
Who publishes it

rapidcatch - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
rapidcatch
Website
rapidcatch.com/en/help/

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Cookie sync now also sends a browser and device fingerprint to rapidcatch.com

MediumunwantedCWE-359Dynamic sandbox

Each cookie sync POST to rapidcatch.com now carries a fingerprint field with browser version, CPU architecture and platform details.

What actually happens

You did this

A cookie sync fires after an eBay cookie changes or a manual sync is requested.

The extension did this

The extension adds a device and browser fingerprint to the cookie POST sent to rapidcatch.com.

Dynamic analysis of v3.33 observed the fingerprint field in the sync request body; v3.28 sent only the cookie field.

Captured request

POSThttps://rapidcatch.com/platform/sync/a/

HTTP 200. Other observed syncs in the same run carried eBay cookie records in the json field alongside the same fingerprint field.

Body
json=%5B%5D&fingerprint=%7B%22userAgent%22%3A%22Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_15_7%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F146.0.0.0+Safari%2F537.36%22%2C%22acceptLanguage%22%3A%22en-US%22%2C%22language%22%3A%22en-US%22%2C%22languages%22%3A%5B%22en-US%22%5D%2C%22navigatorPlatform%22%3A%22Linux+x86_64%22%2C%22hardwareConcurrency%22%3A12%2C%22deviceMemory%22%3A16%2C%22timezoneOffset%22%3A0%2C%22extensionVersion%22%3A%223.33%22%2C%22timeZone%22%3A%22UTC%22%2C%22locale%22%3A%22en-US%22%2C%22calendar%22%3A%22gregory%22%2C%22numberingSystem%22%3A%22latn%22%2C%22mobile%22%3Afalse%2C%22platform%22%3A%22macOS%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google+Chrome%22%2C%22version%22%3A%22146%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22146%22%7D%2C%7B%22brand%22%3A%22Not_A+Brand%22%2C%22version%22%3A%2224%22%7D%5D%2C%22architecture%22%3A%22arm%22%2C%22bitness%22%3A%2264%22%2C%22model%22%3A%22%22%2C%22platformVersion%22%3A%2214.4.0%22%2C%22uaFullVersion%22%3A%22146.0.0.0%22%2C%22fullVersionList%22%3A%5B%7B%22brand%22%3A%22Google+Chrome%22%2C%22version%22%3A%22146.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22146.0.0.0%22%7D%2C%7B%22brand%22%3A%22Not_A+Brand%22%2C%22version%22%3A%2224.0.0.0%22%7D%5D%7D&profileId=06b6f7e0-b241-42cc-b02f-4d157ba3c9ef&clientVersion=1&capturedAt=1792838227765

Fingerprint values observed in the request body

  • Browser and OS version
    Chrome 146.0.0.0 on macOS 14.4.0

    Exact browser build and platform version narrow your device to a small group.

  • CPU architecture
    arm, 64-bit

    Reveals the processor type and word size of your computer.

  • Hardware profile
    12 threads, 16 GB

    CPU thread count and memory size add to how unique the device looks.

  • Language and time zone
    en-US, UTC

    Locale settings add context about where and how the browser is configured.

  • Profile identifier
    06b6f7e0-b241-42cc-b02f-4d157ba3c9ef

    A profile ID in the same request can link repeated syncs from one browser.

Where the request is sent

    • rapidcatch.com

    Receives the cookie sync POST including the fingerprint field.

Updated 2 November 2026lipfgikjgiomnaimfagefeljjimbhlha