When you create a profile in the official @narendramodi #Android app, all your device info (OS, network type, Carrier …) and personal data (email, photo, gender, name, …) are send without your consent to a third-party domain called in.wzrkt.com. 
This domain is classified as a phishing link by the company G-Data. This website is hosted by @GoDaddy and the whois info are hidden.
After a quick search, this domain belongs to an American company called @CleverTap. According to their description, “#CleverTap is the next generation app engagement platform. It enables marketers to identify, engage and retain users and provides developers"
Of course, I reversed their SDK, the JAR file provided on #Github.
First observation, nothing is obfuscated.
Secondly, this SDK is very light…
Finally, we can confirm that the domain wzrkt.com is the property of @CleverTap.
First observation, nothing is obfuscated.
Secondly, this SDK is very light…
Finally, we can confirm that the domain wzrkt.com is the property of @CleverTap.
.@Clevertap why did you mask the whois info of wzrkt.com?
.@narendramodi, I know privacy is not your thing but any thoughts about sharing the personal data of your users without their consent to a third-party company?
• • •
Missing some Tweet in this thread? You can try to
force a refresh
