Is WEB.DE MailCheck for Firefox safe?

Low risk

WEB.DE MailCheck for Firefox enables analytics on update and ships hardcoded OAuth client secrets for four mail providers.

When upgrading from versions before 8.0.0, the extension automatically sets analytics opt-in flags and begins sending daily, weekly, and monthly usage events — including a persistent device ID, account counts, browser language, and user segment — to tgw.web.de. Additionally, the extension bundle contains hardcoded Basic-auth credentials for OAuth token endpoints at GMX, GMX.com, mail.com, and WEB.DE, which are sent as Authorization headers during token refresh.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

1&1 Mail & Media GmbHv8.0.18Firefox Add-ons
17Risk
Who publishes it

1&1 Mail & Media GmbH - no other listings under this identity, 33 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
1&1 Mail & Media GmbH
Website
produkte.web.de/mailcheck

Shared hosts - 33 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

mail.com
Also called by 2 other listings
navigator-lxa.mail.com
Also called by 2 other listings
gmx.net
Also called by 3 other listings, including Fenerbahçe SK Anasayfa
go.gmx.com
Also called by 3 other listings, including mail.com MailCheck
search.gmx.com
Also called by 3 other listings, including mail.com MailCheck
suche.1und1.de
Also called by 3 other listings, including GMX MailCheck for Firefox
suggestplugin.1und1.de
Also called by 3 other listings, including GMX MailCheck for Firefox, GMX.com MailCheck for USA, CA, UK, FR and ES
suggestplugin.gmx.com
Also called by 3 other listings, including GMX MailCheck for Firefox, GMX.com MailCheck for USA, CA, UK, FR and ES
suggestplugin.gmx.net
Also called by 3 other listings, including GMX.com MailCheck for USA, CA, UK, FR and ES, mail.com MailCheck
suggestplugin.mail.com
Also called by 3 other listings
suggestplugin.ui-portal.de
Also called by 3 other listings, including GMX.com MailCheck for USA, CA, UK, FR and ES, mail.com MailCheck
suggestplugin.web.de
Also called by 3 other listings, including GMX MailCheck for Firefox
tgw.web.de
Also called by 3 other listings, including MailCheck
go.web.de
Also called by 4 other listings, including MailCheck
oauth2.gmx.net
Also called by 4 other listings
search.mail.com
Also called by 5 other listings, including MailCheck
suche.web.de
Also called by 5 other listings, including MailCheck
1und1.de
Also called by 6 other listings
adsensecustomsearchads.com
Also called by 6 other listings, including MailCheck, MailCheck
gmx.com
Also called by 6 other listings
suche.gmx.net
Also called by 6 other listings
bs.navigator.gmx.net
Also called by 7 other listings
bs.navigator.web.de
Also called by 7 other listings
dl.1und1.de
Also called by 7 other listings
dl.gmx.com
Also called by 7 other listings
dl.mail.com
Also called by 7 other listings
lts.1und1.de
Also called by 7 other listings, including MailCheck
oauth2.mail.com
Also called by 7 other listings
uas2.uilogin.de
Also called by 7 other listings, including MailCheck
wikipedia.de
Also called by 7 other listings
img.ui-portal.de
Also called by 8 other listings
oauth2.gmx.com
Also called by 8 other listings
netid.de
Also called by 9 other listings

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

What it can do

Permissions this extension asks for, as declared in version 8.0.18. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on web.de

    https://*.web.de/*

  • Act on the current tab, but only after you click the extension

    activeTab

  • See the address and title of every tab you have open

    tabs

  • Store data in your browser

    storage

  • See, disable and uninstall your other extensions, including your security ones

    management

  • Show you desktop notifications

    notifications

  • Add items to the right-click menu

    contextMenus

  • Sign you in with your Google account

    identity

  • Run searches with your default search engine

    search

Where it sends data

Destinations our analysis observed WEB.DE MailCheck for Firefox contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • oauth2.gmx.com

    WEB.DE MailCheck for Firefox sends data to oauth2.gmx.com. 2 other extensions we have analyzed send data here.

  • oauth2.gmx.net

    WEB.DE MailCheck for Firefox sends data to oauth2.gmx.net. 2 other extensions we have analyzed send data here.

  • oauth2.mail.com

    WEB.DE MailCheck for Firefox sends data to oauth2.mail.com. 2 other extensions we have analyzed send data here.

  • oauth2.web.de

    WEB.DE MailCheck for Firefox sends data to oauth2.web.de. 2 other extensions we have analyzed send data here.

  • tgw.web.de

    WEB.DE MailCheck for Firefox sends data to tgw.web.de. No other extension we have analyzed sends data here.

Updated 2 November 2026amo-375375