Is وسهام | VaSaham safe?

Low risk

VaSaham fetches Tehran Stock Exchange market data over plaintext HTTP from tsetmc.com and a set of hardcoded raw-IP mirror hosts.

VaSaham is an Iranian bourse tool that pulls live market data, technical indicators and shareholder figures for stock instruments. Its service worker and content scripts request that data over unencrypted HTTP from cdn.tsetmc.com and several hardcoded raw-IP mirrors, so the instrument IDs queried and the responses are visible to anyone on the network path. The build also ships a bundled OneSignal SDK that would read the user's Google account ID via chrome.identity, but no active script loads it in this version.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

AlirezA Mohv6.1Chrome Web Store
15Risk
Who publishes it

VaSaham - no other listings under this identity, 8 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
AlirezA Moh
Declared legal entity
VaSaham
Website
vasaham.com/ticket

Shared hosts - 8 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

main.tsetmc.com
Also called by 1 other listing: لایو تی‌اس‌ای | Livetse
sahamyab.com
Also called by 1 other listing: TSETMC PLUS
tsetmc.ir
Also called by 1 other listing: لایو تی‌اس‌ای | Livetse
codal.ir
Also called by 3 other listings: لایو تی‌اس‌ای | Livetse, TSETMC PLUS, MetaTSE
tsetmc.com
Also called by 3 other listings: لایو تی‌اس‌ای | Livetse, TSETMC PLUS, MetaTSE
old.tsetmc.com
Also called by 4 other listings, including TSETMC PLUS, MetaTSE, Vitamin TSETMC - ویتامین بورس
strangeplanet.fr
Also called by 4 other listings, including TubeBuddy, WorkBoard
cdn.tsetmc.com
Also called by 5 other listings

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

What it can do

Permissions this extension asks for, as declared in version 6.0.13. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 6.1, which we have not unpacked yet.

  • Read and change your data on onesignal.com

    *://*.onesignal.com/*

  • Read and change your data on sahamyab.com

    *://*.sahamyab.com/*

  • Read and change your data on rahavard365.com

    *://*.rahavard365.com/*

  • Read and change your data on tablokhani.ir

    *://*.tablokhani.ir/*

  • Read and change your data on tablokhani.com

    *://*.tablokhani.com/*

  • Read and change your data on vasaham.com

    *://*.vasaham.com/*

  • Read and change your data on vasaham.ir

    *://*.vasaham.ir/*

  • Add items to the right-click menu

    contextMenus

  • Receive push messages from its developer's servers

    gcm

  • Store data in your browser

    storage

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Show you desktop notifications

    notifications

  • Sign you in with your Google account

    identity

Where it sends data

Destinations our analysis observed وسهام | VaSaham contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • cdn.tsetmc.com

    وسهام | VaSaham sends data to cdn.tsetmc.com. No other extension we have analyzed sends data here.

  • onesignal.com

    وسهام | VaSaham sends data to onesignal.com. No other extension we have analyzed sends data here.

  • tsetmc.com

    وسهام | VaSaham sends data to tsetmc.com. No other extension we have analyzed sends data here.

  • vasaham.com

    وسهام | VaSaham sends data to vasaham.com. No other extension we have analyzed sends data here.

Updated 30 September 2026ijbhcaojmmmlpkghcejkoadlfhghkkoj