Is Recorded Future safe?
Recorded Future scans every page you visit for IOC-shaped strings and sends them to its own risk-scoring API.
On every http(s) or local file page you open, a content script scans the visible page text and link URLs for patterns that look like IPs, domains, file hashes, CVE IDs, or URLs. The background service worker batches these extracted strings (up to 200 at a time) and sends them, tagged with your Recorded Future login token, to Recorded Future's own enrichment API, which returns threat risk scores that the extension displays as highlights on the page and in its popup.
Who publishes itRecorded Future - no other listings under this identity
Recorded Future - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed Recorded Future contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- express-api.recordedfuture.com
Recorded Future sends data to express-api.recordedfuture.com. No other extension we have analyzed sends data here.