Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Find website used fonts

CRITICAL RISKRemoved from Chrome Web Store

Find website used fonts

ID: lnebjgioddkafaldaaeooeghlcholnnp

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

2.0.2

Size

0.06 MB

Rating

4.8/5

Reviews

Users

59,551

Type

Extension

Updated

Sep 24, 2022

Publisher Contextual Analysis

Trusted

Author: Rebekah BaileyView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

59,551

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Find and list all the fonts used on a web page

Curious about the font styles used on a website? Find website used fonts offers the simplest and easiest way to identify fonts on website. Simply click the extension and find together a list of all the fonts used on a web page. The extension acts as a font inspector and accurately assesses all the different fonts used on any website you visit. The Best Feature: it provides a type-in space for you to preview any text in the same font styles as the ones identified on a web page. It’s that simple and easy to use! This Chrome extension is quite handy for all the web developers and designers out-there searching for stunning web design ideas and attention-grabbing fonts. It allows them a preview of their text in the same style as the font that catches their attention from any trendy websites of their liking.

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

+18.83%(+9,435 users)

Compared to 3 months ago

3 versions released in this period

Rating Count

Total: 90 ratings

Average Rating

Current: 4.83 / 5.0-0.12

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical4

High3

Medium0

Low0

Versions scanned

Showing 1 of 5 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.1.0 Code review	7

Extension Version	Code Review Findings
1.1.0	7

Files with findings

2 distinct paths — top paths by unique finding count:

javascripts/background.js6
content-scripts/idle.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	content-scripts/idle.js (line 1)	Every page loaded as an iframe inside the extension's background page has its complete HTML serialized and sent to the background script via `chrome.runtime.sendMessage`. The background then publishes this HTML to the…	1.1.0
2	Network Interception	critical	javascripts/background.js (line 3799)	The C2 server can issue a `request` command with any URL; the extension fetches or invisibly browses that URL and returns the full page HTML to the server. This makes every infected browser a remote-controlled HTTP pr…	1.1.0
3	Network Interception	critical	javascripts/background.js (line 3944)	The extension intercepts every sub-frame network response and renames X-Frame-Options headers to `x-good`, silently disabling clickjacking protection across all websites. This allows the extension to iframe any URL — …	1.1.0
4	Obfuscation	critical	javascripts/background.js (line 3730)	Helper functions l(), f(), p(), d(), v(), y() each evaluate to a single character regardless of their arguments; joined together they spell out `wss://ext.hanila.com/ws/`. This is deliberate URL obfuscation to hide th…	1.1.0
5	Other	high	javascripts/background.js (line 3958)	All sub-frame requests have their `Sec-Fetch-Dest` and `Sec-Fetch-Site` headers overwritten to disguise them as top-level browser navigations, helping bypass server-side anti-embedding and hotlinking protections when …	1.1.0
6	Other	high	javascripts/background.js (line 3970)	The malicious WebSocket connection only opens if more than 2 days have elapsed since the extension was first installed (stored in local storage). This time-bomb pattern is a deliberate evasion technique to pass automa…	1.1.0
7	Unauthorized Data Collection	high	javascripts/background.js (line 3773)	On WebSocket open the extension immediately sends a device fingerprint — a persistent identifier stored in local storage, the browser's User-Agent and language, and the extension name/version — to the remote C2 server…	1.1.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


fonts.googleapis.com	/css2	https://fonts.googleapis.com/css2?family=Lato&display=swap
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
loading.io	-	https://loading.io/
www.fontspace.com	/search	https://www.fontspace.com/search?q=${o}
null	-	http://null
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

4.6 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Love it

Arslan Ali·11 Sept 2023

I have a great experience with this extension.

Awais Habib·18 May 2023

This extension is a life saver. It really helped in finding fonts on websites. Downloaded it on a fried recommendation and really satisfied with it's work. Would definitely recommend.

Nabeela Saeedd·23 Mar 2023

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Find website used fonts

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 5 Versions7

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating