Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Blockano Adblocker

CRITICAL RISKRemoved from Chrome Web Store

Blockano Adblocker

ID: inejjjikomlbaahobecdaoaillmfejil

Could be malicious

Extension Info & Metadata

Status

Removed

Version

1.2.15

Size

0.41 MB

Rating

4.0/5

Reviews

Users

531,627

Type

Extension

Updated

Dec 4, 2020

Publisher Contextual Analysis

Author: Monte SporerView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

531,627

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Fast and reliable ad blocking software.

Blocano is an adblocking software. Good, fast, reliable Features: ⭐ Easy setup - no need to configure ⭐ Low memory footprint ⭐ Control adblocking with whitelists

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High1

Medium7

Low1

Versions scanned

Showing 2 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.2.15 Code review	6
1.2.14 Code review	6

Extension Version	Code Review Findings
1.2.15	6
1.2.14	6

Files with findings

4 distinct paths — top paths by unique finding count:

bg.js6
content.js3
popup.html2
subscriptions.xml1

S.No.	Category	Severity	File	Summary	Found in Version
1	Network Interception	critical	bg.js (line 6)	This extension is a modified fork of AdBlock Plus with all critical server-side infrastructure replaced by operator-controlled domains (easyadblocker.com). The 'acceptable ads' exception/whitelist rules — which contro…	1.2.14
2	Network Interception	critical	subscriptions.xml (line 1)	All 23 language-specific EasyList filter subscriptions are routed through rules.easyadblocker.com instead of their authoritative CDN origins (easylist.to, GitHub, etc.). While the homepage attributes still reference l…	1.2.14
3	Remote Code Loading	critical	bg.js (line 6)	The extension fetches a JSON payload from cdn.easyadblocker.com/notification.json on a recurring schedule (every hour, with expiration backoff). The downloaded notification data is parsed and displayed to users as bro…	1.2.14
4	Remote Code Loading	high	bg.js (line 265)	This block obfuscates a Google Tag Manager loader by splitting string literals and reconstructing the remote URL from the manifest CSP, then appends the resulting element into the background page DOM. Loading GTM insi…	1.2.15
5	Code Injection	medium	content.js (line 1108)	This content script injects code into page-owned frame contexts using `contentWindow.eval`, explicitly bypassing normal extension isolation boundaries. That pattern is risky because it executes script in the same real…	1.2.15
6	Code Injection	medium	content.js (line 1291)	The extension also injects a Blob-backed `<script>` tag directly into every HTML page/frame where scripts are allowed. Generating executable code on the fly and inserting it into web pages is a classic code-injection …	1.2.15
7	Code Injection	medium	content.js (line 4)	The content script serializes and eval()-injects a copy of itself into every child iframe and frame on every page visited, using contentWindow.eval(). While this pattern exists in legitimate AdBlock Plus code for cros…	1.2.14
8	Other	medium	bg.js (line 10156)	The extension periodically downloads and applies a remote JSON notification feed from `Prefs.notificationurl` (`https://cdn.easyadblocker.com/notification.json`). This gives the operator a server-side control plane fo…	1.2.15
9	Tracking	medium	bg.js (line 10255)	Remote notifications are filtered against the user's current page URL and hostname, allowing the server-controlled feed to target messages to specific browsing destinations. Even without explicit exfiltration here, th…	1.2.15
10	Tracking	medium	popup.html (line 1)	The popup UI loads Font Awesome from an external CDN (cdnjs.cloudflare.com) instead of bundling it locally as every extension should. Every time a user opens the extension popup, their IP address, browser fingerprint,…	1.2.14
11	Unauthorized Data Collection	medium	bg.js (line 6)	The extension collects and encodes telemetry at uninstall time including addon name/version, browser application and version, platform and platform version, notification download count ranges, and a data-corruption fl…	1.2.14
12	Remote Code Loading	low	popup.html (line 1)	The popup UI loads a stylesheet directly from a third-party CDN at runtime instead of packaging all resources locally. Remote dependencies in an extension UI are suspicious because they allow external parties to influ…	1.2.15

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


rules.easyadblocker.com	/easylist.txt	https://rules.easyadblocker.com/easylist.txt
easylist.to	-	https://easylist.to/
rules.easyadblocker.com	/abpindo+easylist.txt	https://rules.easyadblocker.com/abpindo+easylist.txt
abpindo.blogspot.com	-	http://abpindo.blogspot.com/
rules.easyadblocker.com	/abpvn+easylist.txt	https://rules.easyadblocker.com/abpvn+easylist.txt
abpvn.com	-	http://abpvn.com/
rules.easyadblocker.com	/bulgarian_list+easylist.txt	https://rules.easyadblocker.com/bulgarian_list+easylist.txt
stanev.org	/abp/	http://stanev.org/abp/
rules.easyadblocker.com	/easylistchina+easylist.txt	https://rules.easyadblocker.com/easylistchina+easylist.txt
abpchina.org	/forum/	http://abpchina.org/forum/

Showing 1 to 10 of 60 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

4.0 out of 5 · 1 most recent review

Text reviews

Positive

Negative

Regular +

Joma Bastos G P·11 Jan 2021

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Blockano Adblocker

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions12

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews