Is Wallet Highlighter - Crypto Fraud & Risk Tool safe?
Wallet Highlighter - Crypto Fraud & Risk Tool is medium risk. On every page, Wallet Highlighter's risk lookup sends the full page URL and up to 100 characters of nearby page or input text, not just the wallet address. A planted wallet and marker string both left in the request during testing.…
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Wallet Highlighter sends the page URL and nearby text with every wallet check
On every page, Wallet Highlighter's risk lookup sends the full page URL and up to 100 characters of nearby page or input text, not just the wallet address.
A planted wallet and marker string both left in the request during testing.
You browse to any webpage that contains a crypto wallet address or email, anywhere in the page text or a form field.
No interaction with the extension is required; the content script runs on every site.
The extension sends that wallet along with the page's full URL and nearby page or form text to its own risk-scoring server.
This runs automatically on page load and again whenever the page's content changes, with no prompt.
| Field | Value | Why it matters | |
|---|---|---|---|
Wallet address | 0x71C7656EC7ab88b098defB751B7401B5f6d8976F | The crypto wallet address you're checking. Sending this matches the extension's stated risk-lookup purpose. | |
Full page URL | https://en.wikipedia.org/wiki/Bitcoin?ref=aff-9182 | The exact page you were on, including query-string parameters, sent even though a risk score only needs the wallet. | |
Nearby page text | <div id="payment-note"> Please send the payment to my wallet 0x71C7656EC7ab88b098defB751B7401B5f6</div> | Up to 100 characters of text from the page or a nearby form field, which can include whatever is written near the address. | |
Device identifier | a3f1c9e2-8b4d-4e91-9c3a-7d2f5b1e6c40 (illustrative) | A persistent ID that ties every risk lookup, on every site, back to the same browser. | |
Site hash | efcb5e7c26d69553cab9ec280c40bba8b66f24aa3bdffae200e54cbfa87f05fc (illustrative) | A hash of the site's origin, sent in addition to the full URL above rather than instead of it. |
| Content-Type | application/json |
{
"domainHash": "...",
"wallets": [
"0x71C7656EC7ab88b098defB751B7401B5f6d8976F"
],
"siteUrl": "https://en.wikipedia.org/wiki/Bitcoin?canary_query=CANARY9182",
"userID": "...",
"contexts": {
"0x71C7656EC7ab88b098defB751B7401B5f6d8976F": [
"...<div id=\"canary-wallet-context\"> Please send the payment CANARY_CONTEXT_MARKER_9182 to my wallet 0x71C7656EC7ab88b098defB751B7401B5f6</div>..."
]
}
}Building the request: full URL and ancestor-element text alongside the wallet
async function getRiskDetailsFromApi(domainHash, wallets, contexts) {
if (!domainHash || !wallets || !wallets.length) return null;
try {
const siteUrl = window.location.href;
const userID = await getOrCreateUserId();
if (userID === undefined) throw new Error("userID cannot be undefined");
const response = await fetch(RISK_API_URL, {
method: "POST",
body: JSON.stringify({ domainHash, wallets, siteUrl, userID, contexts }),
headers: { "Content-Type": "application/json" }
});
return await response.json();
} catch (err) {
console.error("Error getting colors", err);
return null;
}
}function getNearestContext(element) {
const ancestors = [];
for (let node = element; node; node = node.parentElement) ancestors.push(node);
const describe = (el) => {
const tag = el.tagName.toLowerCase();
const id = el.id ? ` id="${el.id}"` : "";
const classes = Array.from(el.classList).filter(c => c !== "blackworks-highlighted");
const cls = classes.length ? ` class="${classes.join(" ")}"` : "";
if (tag === "meta") {
const attrs = Array.from(el.attributes).map(a => `${a.name}="${a.value}"`).join(" ");
return `<meta ${attrs} />`;
}
const isFormField = (tag === "textarea" || tag === "input") && el.value;
const text = isFormField
? ` ${el.value.trim().slice(0, 100).replace(/\s+/g, " ")}`
: (tag !== "html" && tag !== "body" && tag !== "head" && el.innerText)
? ` ${el.innerText.trim().slice(0, 100).replace(/\s+/g, " ")}`
: "";
return `<${tag}${id}${cls}>${text}</${tag}>`;
};
const reversed = ancestors.reverse();
const closest3 = reversed.slice(0, 3).map(describe);
const farthest5 = reversed.slice(-5).map(describe);
return [...closest3, "....", ...farthest5];
}- api.wallethighlighter.com
Wallet Highlighter's own backend. Receives every wallet/email risk lookup plus the full page URL and nearby page text from every site you visit.
Paste into the DevTools console before visiting a page with a wallet address to see the exact fields Wallet Highlighter sends off your device.
(function () {
const target = "wallethighlighter.com/v1/";
const originalFetch = window.fetch;
window.fetch = function (input, init) {
const url = typeof input === "string" ? input : (input && input.url);
if (url && url.includes(target) && init && init.body) {
try {
const body = JSON.parse(init.body);
console.log("[wallet-highlighter-capture-check] outgoing request to", url);
console.log(" siteUrl sent:", body.siteUrl);
console.log(" contexts sent:", body.contexts);
console.log(" full body:", body);
} catch (e) {
console.log("[wallet-highlighter-capture-check] outgoing request to", url, "raw body:", init.body);
}
}
return originalFetch.apply(this, arguments);
};
console.log("[wallet-highlighter-capture-check] fetch monitor installed. Now interact with a page containing a wallet address.");
})();- 1Open DevTools > Console on any page.
- 2Paste and run the script.
- 3Reveal a wallet address on the page or in an input field.
- 4It logs the outgoing request's URL and body.
Hovered wallet and email addresses sent to PostHog analytics
Hovering over highlighted wallet/email addresses batches them into a popup_on_highlighted_addresses event sent to us.i.posthog.com, carrying a persistent random user ID that links page-derived address data to a stable install.
The user moves the pointer over a highlighted wallet or email address.
The extension batches the detected address values and sends them in a PostHog analytics event tied to a persistent user ID.
| Field | Value | Why it matters | |
|---|---|---|---|
Highlighted Wallet/Email Address | 0x742d35cc6634c0532925a3b844bc454e4438f44e (illustrative) | This page-derived value can reveal which wallet or email address the user hovered over while browsing. | |
Persistent extension user ID | a3f91c2e7b4d8a6f5c0e9d12b7a4c8f0 (illustrative) | This storage-backed identifier can link multiple analytics events from the same browser install. |