This is how people get malicious addons

Viruses and worms
1

Annoying webpage locks you in and wants you to install their dirty addon.

So now even adware guys are using ransomware type behaviour. ???

b.india-india.xyz/?hash=ca5a0b9f62d76aa7bc936eb100761e58&nxtext=0

mbape.racing/b.php?clickid=1498100138193396609926139274037611&n=w1&v=1737893645

reported to avast from e-mail.

EDIT: Reported as dead by pondus and now is again working.Second link is down but no way to tell when it will be back up.

2

Remembers me of something.

I had a link on a webpage saying “Don’t click this link”.
Within a day several hundreds of people clicked it.

3

The problem is these things are wide in the open and still it goes under AV vendors nose.This is like a browserlocker forcing you to install their addon (which probably does something malicious too)

4

Easy enough to get out of: Run a sandbox which you can force-quit if needed.

5

Possible taken down, seems file is no longer there

urlQuery >> http://urlquery.net/queued.php?id=2552459174

6

Here is one more:
/mbape.racing/b.php?clickid=1498100138193396609926139274037611&n=w1&v=1737893645

7

Please crop images when posting them to show only the relevant information as they don’t easily fit within the forum layout without much scrolling. These massive images that are mostly blank are a pain.

I don’t use Chrome, Firefox has settings to help prevent sites install add-ons (Firefox > Options > Security), does Chrome not have something similar.

8

And yet there is no block on both the sites.E-mailed them again. :slight_smile:

9

I have blocked both domains now :wink: