Is Serpstat Website SEO Checker safe?

Medium risk

Serpstat Website SEO Checker records every URL visited and periodically uploads the full browsing history to plugin.serpstat.com.

On each tab switch, the extension collects the current URL and timestamp, building a local history array. This history is encoded and POSTed to plugin.serpstat.com/history at an interval set by the server. Separately, the extension fetches the user's real public IP address at startup and includes it in analytics events sent to Google Analytics and a third-party OWOX analytics endpoint.

serpstat.comv5.0.1Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Device and identity fingerprint sent to Google Analytics and a third-party host

On startup and navigation, the worker sends an analytics payload, ID UA-11773021-10, to google-analytics.com/collect and google-analytics.bi.owox.com: client ID (cid/cd6), Serpstat uid (cd1), device memory (cd7), resolution (sr), IP (uip).

01EvidenceCAUSE EFFECT
What actually happens
You did this

You switch tabs or load a page with the extension installed.

Startup, install and tab-navigation events all trigger the analytics send() routine.

The extension did this

The service worker sends a fingerprint payload to Google Analytics and to a third-party OWOX host.

The same parameter set goes to both www.google-analytics.com/collect and google-analytics.bi.owox.com.

02EvidenceFIELD TABLE
Parameters carried in each analytics event
FieldValueWhy it matters
Persistent client ID
f642579720.1781525329Long-lived identifier generated on install and stored locally, sent as cid and cd6. Ties events back to the same browser over time.
Account user ID
user_id ("Unregistered" when signed out)Your Serpstat account user ID, sent as uid and cd1 when you are signed in. It links the analytics stream to a named account.
Public IP address
82.3.220.102Your device's real public IP, fetched from api.ipify.org and sent as uip.
Device memory
16The device's reported RAM in gigabytes from navigator.deviceMemory, sent as cd7. A fingerprinting input.
Screen resolution
1920x1080The screen width and height, read via the scripting API and sent as sr. A fingerprinting input.
Browser
chromeThe detected browser name, sent as the browser parameter.
03EvidenceCODE COMPARE
The code that does this

send() serialises the parameter set and posts it to both the Google Analytics URL and the OWOX URL

What it actually does
background.bundle.js — send(): one query string, two destinationsjs/background.bundle.js
var gaUrl = t.gaUrl,      // https://www.google-analytics.com/collect
    owoxUrl = t.owoxUrl;  // https://google-analytics.bi.owox.com/UA-11773021-10
var qs = "?";
for (var key in t) {
  qs += t[key] && t[key].length > 0 ? key + "=" + t[key] + "&" : "";
}
fetch({ url: owoxUrl + qs });  // send fingerprint to OWOX host
fetch({ url: gaUrl + qs });    // send identical payload to Google Analytics
04EvidenceNETWORK CAPTURE
Captured request
GEThttps://google-analytics.bi.owox.com/UA-11773021-10?tid=UA-11773021-10&t=event&cid=f642579720.1781525329&cd6=f642579720.1781525329&cd7=16&browser=chrome&uip=82.3.220.102&sr=1920x1080
Captured during dynamic analysis: the fingerprint payload sent to the third-party OWOX host, carrying the persistent client ID, device memory (cd7=16), browser, public IP (uip) and screen resolution. The identical parameter set was also sent to www.google-analytics.com/collect. Reproduced across two runs.
05EvidenceTHIRD PARTY LIST
Where the fingerprint payload is sent
  • www.google-analytics.com

    Google Analytics collection endpoint; receives the full fingerprint payload under tracking ID UA-11773021-10.

  • google-analytics.bi.owox.com

    Third-party analytics host (OWOX BI), not Google Analytics; receives the same payload, including client ID, account ID, device memory, resolution and IP.

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-200
SourceAI SANDBOX

Public IP fetched from an echo service and attached to every analytics event

On startup, the background worker fetches the device's public IP from api.ipify.org and includes it as 'uip' on every analytics event, sent to Google Analytics and google-analytics.bi.owox.com.

The IP was unchanged across two test runs.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You start your browser with the extension installed.

No interaction is required; the analytics module initialises automatically.

The extension did this

The background service worker requests your public IP from api.ipify.org and stores it.

The returned IP string is held in memory and reused on every subsequent analytics event.

02EvidenceCODE COMPARE
The code that does this

The analytics init routine fetches the public IP and saves it as the 'uip' parameter

What it actually does
background.bundle.js — analytics init()js/background.bundle.js
e.gaParams.cd7 = "".concat(navigator.deviceMemory);
l.default.fetchText({
  url: "https://api.ipify.org"
}).then(function (t) {
  e.gaParams.uip = t;   // store the returned public IP string
});
03EvidenceNETWORK CAPTURE
Captured request
GEThttps://api.ipify.org
Returns the device's real public IP as a plain text string (the value captured during dynamic analysis was 82.3.220.102, the test machine's IP).
04EvidenceNETWORK CAPTURE
Captured request
GEThttps://www.google-analytics.com/collect?tid=UA-11773021-10&t=pageview&cid=f642579720.1781525329&uip=82.3.220.102
The same IP returned by ipify appears as the uip parameter on the outbound Google Analytics event. The identical value was also sent to https://google-analytics.bi.owox.com/UA-11773021-10. Reproduced across two dynamic-analysis runs.
05EvidenceTHIRD PARTY LIST
Hosts involved in obtaining and receiving the IP
  • api.ipify.org

    Public-IP echo service queried on startup; returns the device's real public IP.

  • www.google-analytics.com

    Google Analytics collection endpoint; receives the IP as the uip parameter on every event.

  • google-analytics.bi.owox.com

    Third-party analytics host (OWOX BI); receives the same event payload including the uip parameter under tracking ID UA-11773021-10.

Data recipients

plugin.serpstat.comwww.google-analytics.comgoogle-analytics.bi.owox.comapi.ipify.org
Updated 17 September 2026fcgbopaomlpldhbinhgebmkcnkfconmn