Is Wanteeed safe?

Question

Is Wanteeed safe?

Accepted Answer

Our review of Wanteeed surfaced the following. When you visit a hotel page on a supported booking site (booking.com, hotels.com, tripadvisor.com, kayak.com, marriott.com, expedia.com, priceline.com), the bundled vio.com SDK (hermesSDK.js, loaded as a content script on every HTTPS page) posts an analytics event to https://fe-evas.fih.io/browser-extension/event. We observed three such POSTs during booking.com hotel-page visits. Each request carries the full page URL with all marketing and affiliate query parameters intact, the page domain, the page path, the browser name, a persistent anonymous ID stored in chrome.storage.local, the affiliate name 'wanteeed', and the SDK version. The endpoint is authenticated with a hardcoded x-api-key. The fetch fires automatically on hotel page load with no user interaction required. We observed wanteeed posting an analytics event to its server (https://d2.wanteeed.com/publish, the alternative endpoint selected by the perm.extension.useAlternativeEventEndpoint feature flag) that contained the visitor's public IP address (82.3.220.102 in our session), a persistent device ID, browser name and version, and the full feature-flag string in user_properties. The same JSON shape and the same data fields are sent to the primary d.wanteeed.com/publish endpoint described in the source code. The IP is fetched once from https://ext.wanteeed.com/ext/get_country, cached in chrome.storage.local under the key 'ip', and reattached to every later event payload. Events only fire after the consent screen shown on install has been acknowledged or skipped.

Is wanteeed safe?

Findings