Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Ads Blocker

CRITICAL RISKRemoved from Chrome Web Store

Ads Blocker

ID: ngahaphlngmdfhbhkplbglnfhehnpgdb

Could be malicious

Supported Languages

🇺🇸English

🇷🇺Russian

Extension Info & Metadata

Status

Removed

Version

7.1.9

Size

2.85 MB

Rating

4.5/5

Reviews

591

Users

100,000

Type

Extension

Updated

Sep 26, 2024

Publisher Contextual Analysis

Trusted

Author: https://adsblocker.topView Profile
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

100,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Ads Blocker - blocks all annoying ads, malware and tracking.

★ AdsBlocker is the best ad blocker for Google Chrome, Microsoft Edge, Yandex Browser and other Chromium-based browsers. ● Blocks absolutely all ads on websites ● Blocks video ads on YouTube, RuTube and Twitch ● Removes all sponsored posts on Facebook ● Removes all advertising posts VKontakte ● Protects against malicious and phishing sites ● Blocks counters and analytics systems ● Improves page load times ● Blocks cryptocurrency miners ● Protects your personal data by blocking all known web tracking systems ★ Why is AdsBlocker better than AdBlock, Adblock Plus, AdGuard and uBlock? ● Does not ask for personal information to run and does not monitor your online activities ● Blocks all ads before they reach your computer ● Does not use your computer's resources ● Consumes less memory compared to other blockers ● Absolutely free ● Does not require additional settings ● 24/7 technical support ★ Too many ads in Chrome? ● AdsBlocker is a handy ad blocker that blocks video ads and social media sponsored posts ● Blocks ads, pop-ups and malware ● Protects your browser from malware and prevents advertisers from viewing your search history and personal information ● Blocks all animated ads ★ Tired of the fact that search engines give out a bunch of advertising links? ● Removes all sponsored links in all search engines including Google, Bing, Yahoo and others ● Completely removes all ad units from search results ★ Can't use social media properly because of ads? ● Removes all sponsored posts and ads in Facebook videos ● Hides all ads on vk.com, including video and audio ads ● Blocks ads on the ok.ru social network ★ Tired of popup windows? ● Blocks all malicious sites ● Blocks all pop ups and annoying banners ● Blocks ads on adult sites ★ Extension also available for Mozilla Firefox browser

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

No change in user count

Compared to 3 months ago

3 versions released in this period

Rating Count

Total: 564 ratings

Average Rating

Current: 4.55 / 5.0+0.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical5

High3

Medium1

Low0

Versions scanned

Showing 1 of 22 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
7.0.0 Code review	9

Extension Version	Code Review Findings
7.0.0	9

Files with findings

1 distinct path — top paths by unique finding count:

bg.js9

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	bg.js (line 135)	Browsing-history exfiltration: every navigation's hostname is base64-encoded (W=btoa) and accumulated in storage key 'b'. The full list is then concatenated and sent to the remote server on each polling cycle as the `…	7.0.0
2	Network Interception	critical	bg.js (line 80)	Navigation hijacking primitive: I() takes a base64-encoded URL pattern from the remote config, fetches it (often appending the user's current URL as a query string), then calls D() = chrome.tabs.update to redirect the…	7.0.0
3	Network Interception	critical	bg.js (line 539)	tabs.onUpdated listener that, on every page load, base64-decodes a list of target domain patterns ('d') and redirect URL templates ('u') downloaded from the C2 server, then invokes I() to redirect matching tabs to att…	7.0.0
4	Remote Code Loading	critical	bg.js (line 222)	Remote code loading: function R() injects arbitrary JavaScript text fetched from the C2 server (stored as `ccl` in chrome.storage) into the page's MAIN world via a dynamically-created <script> tag. Content comes from …	7.0.0
5	Remote Code Loading	critical	bg.js (line 420)	Fetches arbitrary JavaScript ('custom.txt') from the remote C2 servers (fw-main.adsblocker.top / cf-main.adsblocker.top) and persists the raw response in storage as `ccl`. That string is later piped into chrome.script…	7.0.0
6	Network Interception	high	bg.js (line 455)	Remotely-controlled declarativeNetRequest dynamic rules: rules.txt is downloaded from the C2 and passed straight into chrome.declarativeNetRequest.updateDynamicRules (function b). Because dynamic DNR rules can redirec…	7.0.0
7	Obfuscation	high	bg.js (line 325)	Server-controlled remote kill switch: an HTTP 204 response from the C2 triggers chrome.management.uninstallSelf(). This is a classic anti-forensics / anti-detection mechanism letting operators wipe the malicious exten…	7.0.0
8	Tracking	high	bg.js (line 271)	Hard-coded C2 endpoints (fw-main.adsblocker.top and cf-main.adsblocker.top) and a per-install pseudo-UUID (`uid`) generated at install time. The `config` field is itself updateable from the server (see lines 348-356),…	7.0.0
9	Obfuscation	medium	bg.js (line 339)	All meaningful values from the C2 JSON response (timing, log flag, share-page URL, redirect rule list 'k', and even the C2 host list 'config') are wrapped in atob() before being stored. Base64-wrapping the payload fie…	7.0.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

163

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


${this}`;return	-	https://${this}`;return
fw-main.adsblocker.top	/mv3/chrome/;https://cf-main.adsblocker.top/mv3/chrome/	https://fw-main.adsblocker.top/mv3/chrome/;https://cf-main.adsblocker.top/mv3/chrome/
${location.host}`	-	https://${location.host}`
fw-main.adsblocker.top	/mv3/chrome/uninstall	https://fw-main.adsblocker.top/mv3/chrome/uninstall?uid=${t}&ver=${chrome.runtime.getManifest(
www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/xap/1.0/mm/	http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com	/xap/1.0/sType/ResourceRef	http://ns.adobe.com/xap/1.0/sType/ResourceRef#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
chrome.google.com	/webstore/detail/$%7Bchrome.runtime.id%7D/reviews%60	https://chrome.google.com/webstore/detail/${chrome.runtime.id}/reviews`
..pw	/v/	http://..pw/v/

Showing 1 to 10 of 90 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


37.220.26.135	IPv4	-
37.220.26.136	IPv4	-
37.220.26.137	IPv4	-
52.210.16.150	IPv4	-
77.247.178.41	IPv4	-
78.140.134.198	IPv4	-
78.140.149.216	IPv4	-
88.85.75.147	IPv4	-
88.85.77.92	IPv4	-
91.207.192.31	IPv4	-
95.211.125.226	IPv4	-
193.200.64.24	IPv4	-
206.54.181.250	IPv4	-
37.1.217.113	IPv4	-
37.1.207.65	IPv4	-
37.1.201.32	IPv4	-
5.45.126.35	IPv4	-
5.1.35.2	IPv4	-
78.46.107.144	IPv4	-
88.150.149.92	IPv4	-
149.56.24.226	IPv4	-
139.99.120.222	IPv4	-
90.63.192.161	IPv4	-
198.16.64.66	IPv4	-
213.206.98.70	IPv4	-
23.83.114.131	IPv4	-
62.212.73.45	IPv4	-
46.105.62.117	IPv4	-
176.31.96.119	IPv4	-
5.61.55.143	IPv4	-
37.1.213.100	IPv4	-
188.72.219.36	IPv4	-
38.242.198.170	IPv4	-
5.182.211.129	IPv4	-
176.119.30.88	IPv4	-
185.145.131.204	IPv4	-
158.69.120.31	IPv4	-
5.45.95.74	IPv4	-
185.217.95.44	IPv4	-
1.4.2.1	IPv4	-
111.90.150.149	IPv4	-
111.90.159.132	IPv4	-
173.249.49.204	IPv4	-
117.254.84.212	IPv4	-
35.232.188.118	IPv4	-
35.224.227.218	IPv4	-
34.70.28.179	IPv4	-
109.123.233.251	IPv4	-
185.165.169.108	IPv4	-
141.98.82.232	IPv4	-
157.90.183.248	IPv4	-
162.252.214.4	IPv4	-
167.71.252.38	IPv4	-
167.99.31.227	IPv4	-
172.255.103.118	IPv4	-
172.255.6.135	IPv4	-
172.255.6.137	IPv4	-
172.255.6.139	IPv4	-
172.255.6.140	IPv4	-
172.255.6.150	IPv4	-
172.255.6.152	IPv4	-
172.255.6.199	IPv4	-
172.255.6.217	IPv4	-
172.255.6.228	IPv4	-
172.255.6.248	IPv4	-
172.255.6.252	IPv4	-
172.255.6.254	IPv4	-
172.255.6.2	IPv4	-
172.255.6.59	IPv4	-
185.149.120.173	IPv4	-
188.42.84.110	IPv4	-
188.42.84.137	IPv4	-
188.42.84.159	IPv4	-
188.42.84.160	IPv4	-
188.42.84.162	IPv4	-
188.42.84.21	IPv4	-
188.42.84.23	IPv4	-
194.26.232.61	IPv4	-
203.195.121.0	IPv4	-
203.195.121.103	IPv4	-
203.195.121.119	IPv4	-
203.195.121.11	IPv4	-
203.195.121.134	IPv4	-
203.195.121.184	IPv4	-
203.195.121.195	IPv4	-
203.195.121.1	IPv4	-
203.195.121.209	IPv4	-
203.195.121.217	IPv4	-
203.195.121.219	IPv4	-
203.195.121.224	IPv4	-
203.195.121.229	IPv4	-
203.195.121.24	IPv4	-
203.195.121.28	IPv4	-
203.195.121.29	IPv4	-
203.195.121.34	IPv4	-
203.195.121.36	IPv4	-
203.195.121.40	IPv4	-
203.195.121.46	IPv4	-
203.195.121.70	IPv4	-
203.195.121.72	IPv4	-
203.195.121.73	IPv4	-
203.195.121.74	IPv4	-
23.109.150.208	IPv4	-
23.109.150.253	IPv4	-
23.109.170.212	IPv4	-
23.109.170.228	IPv4	-
23.109.170.241	IPv4	-
23.109.248.125	IPv4	-
23.109.248.129	IPv4	-
23.109.248.130	IPv4	-
23.109.248.135	IPv4	-
23.109.248.139	IPv4	-
23.109.248.149	IPv4	-
23.109.248.14	IPv4	-
23.109.248.174	IPv4	-
23.109.248.183	IPv4	-
23.109.248.20	IPv4	-
23.109.248.229	IPv4	-
23.109.248.247	IPv4	-
23.109.248.29	IPv4	-
23.109.87.123	IPv4	-
23.195.91.195	IPv4	-
34.102.137.201	IPv4	-
37.1.209.213	IPv4	-
51.77.227.100	IPv4	-
51.77.227.101	IPv4	-
51.77.227.102	IPv4	-
51.77.227.103	IPv4	-
51.77.227.96	IPv4	-
51.77.227.97	IPv4	-
51.77.227.98	IPv4	-
51.77.227.99	IPv4	-
51.89.187.136	IPv4	-
51.89.187.137	IPv4	-
51.89.187.138	IPv4	-
51.89.187.139	IPv4	-
51.89.187.140	IPv4	-
51.89.187.141	IPv4	-
51.89.187.142	IPv4	-
51.89.187.143	IPv4	-
88.42.84.136	IPv4	-
167.206.10.148	IPv4	-
127.0.0.1	IPv4	-
110.93.143.144	IPv4	-
180.76.2.18	IPv4	-
66.228.52.30	IPv4	-
67.228.151.70	IPv4	-
74.55.82.102	IPv4	-
79.125.117.123	IPv4	-
85.114.133.62	IPv4	-
213.133.100.18	IPv4	-
149.13.77.20	IPv4	-
190.115.18.20	IPv4	-
185.161.248.253	IPv4	-
52.25.25.125	IPv4	-
184.106.248.76	IPv4	-
200.72.40.46	IPv4	-
91.116.142.114	IPv4	-
184.154.142.242	IPv4	-
187.6.64.32	IPv4	-
109.201.135.79	IPv4	-
5.10.35.208	IPv4	-
104.0.0.0	IPv4	-

Showing 1 to 163 of 170 rows

Rows per page:

3.5 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

відпрацював одразу

Eugen Vakulenko·24 Nov 2024

feedback for improvement. [youtube's playback speed] it has no effect on the youtube's playback speed while this [Ads Blocker] extension is switched on, no matter which speed mode is selected. it won't take effect to the changed playback speed.. ( unless turned off it ).

Sean w·4 Nov 2024

it works screen black for 5 seconds

Jai garg·1 Nov 2024

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Ads Blocker

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 22 Versions9

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating