Is Trackerbot safe?
Trackerbot sends full e-commerce page HTML to its odd-jobs server when server-supplied debug flags request templates.
On Amazon, eBay, and AliExpress order, tracking, and sign-in pages, server-provided debug flags can make the extension scrape the page's full HTML and post it to tracker-bot-odd-jobs-queue.herokuapp.com with the Trackerbot user email and selected supplier account email. During normal extension operations, its Datadog logger also sends logs to http-intake.logs.datadoghq.eu that include the public IP as the hostname and account email or account ID tags.
Who publishes itSaaS Studio - 1 other listing from the same operator, 1 of them carrying a finding
SaaS Studio - 1 other listing from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 1k+ users between them. 1 of them carries a finding.
Shared hosts - 3 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Trackerbot logs your public IP and account email to Datadog on every run
Every time Trackerbot installs or its scheduler runs, it looks up your public IP address and uploads a log entry with that IP and your account email to Datadog, using a write key hardcoded in the extension.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You install Trackerbot, or its background scheduler runs while it's already installed.
This fires whether or not you're signed in, and whether or not Datadog logging has been opted out via stopDDLogs.
Trackerbot looks up your public IP address, then uploads a log entry containing that IP and your account email to Datadog.
The email is your Trackerbot login, plus your selected eBay, Amazon, or AliExpress account when that marketplace flow is active.
HTTP 202 Accepted. 27 log entries in this shape were POSTed during one install plus one scheduler cycle, observed during dynamic analysis.
- DD-API-KEY
- pubd9ccd3cdf99b612012a96a400e1040ad
- Content-Type
- application/json
[ { "ddsource": "SchedulerAPI.checkAll", "ddtags": "supplier:extension,flow:scheduler,operationId:tbv2-la8f3k2x-9h2j1m3p,user:not-logged-in,version:0.2.12.5,result:started,phase:SchedulerAPI.checkAll", "hostname": "187.40.254.11", "message": "SchedulerAPI.checkAll: started", "service": "ManualTbV2", "status": "info" }]- Your public IP address187.40.254.11
Every log entry lists your public IP as its hostname field, tying the activity to your network location.
- Your Trackerbot account emailuser:shopper@example.com (illustrative, not signed in during this capture)
When you're signed in, your account email is attached to the log as a user tag.
- Marketplace account email and IDebayAccount:buyer99@example.com (illustrative)
Your selected eBay, Amazon, or AliExpress account email and account ID are attached whenever that marketplace flow runs.
- Extension version and run contextversion:0.2.12.5, flow:scheduler
The installed extension version and which internal flow (scheduler, sync, backfill) produced the log line.
- api.ipify.org
Returns the device's public IP address; the response is used only to populate Trackerbot's own log entries.
- http-intake.logs.datadoghq.eu
Datadog EU log-intake endpoint. Receives every log line, including your IP and signed-in account identifiers, via a hardcoded write key shared by all installs.
Where it sends data
Destinations our analysis observed Trackerbot contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- api.ipify.orgwidely used
Trackerbot sends data to api.ipify.org. A widely used service: 41 other extensions we have analysed send data here.
- http-intake.logs.datadoghq.eu
Trackerbot sends data to http-intake.logs.datadoghq.eu. One other extension we have analysed sends data here.
- tracker-bot-odd-jobs-queue.herokuapp.com
Trackerbot sends data to tracker-bot-odd-jobs-queue.herokuapp.com. No other extension we have analysed sends data here.