Is VinTracker Auction Helper safe?
VinTracker injects vendor-supplied auction logins and routes Manheim sign-in traffic through a vendor proxy.
For users the vendor flags as dealers, the extension fills Copart, IAAI and Manheim login forms with shared vendor-supplied credentials, sends Manheim authentication traffic through a fixed vendor proxy, and fetches one-time codes from the vendor's Gmail service. It also deletes Copart, IAAI and Manheim cookies every 500ms when no tab for those sites is open, and sends bid actions on g2auction.copart.com (VIN, lot, bid amount, dealer phone) to the vendor's server.
Who publishes itDay Drive - no other listings under this identity, 1 shared hostname
Day Drive - no other listings under this identity, 1 shared hostname
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed VinTracker Auction Helper contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- 209.38.70.234
VinTracker Auction Helper sends data to 209.38.70.234. No other extension we have analysed sends data here.
- api.daydrive.ua
VinTracker Auction Helper sends data to api.daydrive.ua. No other extension we have analysed sends data here.
- chrextsrv.daydrive.ua
VinTracker Auction Helper sends data to chrextsrv.daydrive.ua. No other extension we have analysed sends data here.