Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Paranoid Web Extension

CRITICAL RISKRemoved from Chrome Web Store

Paranoid Web Extension

ID: dnncmhkfafdcmjldmanfjhbeljcfbeao

Could be malicious

Supported Languages

🇧🇬Bulgarian

🇳🇱Dutch

🇺🇸English

🇫🇷French

🇩🇪German

🇬🇷Greek

🇮🇳Hindi

🇭🇺Hungarian

🇮🇹Italian

🇳🇴Norwegian

🇵🇱Polish

🇷🇴Romanian

🇷🇺Russian

🇪🇸Spanish

🇹🇭Thai

🇹🇷Turkish

🇺🇦Ukrainian

🇻🇳Vietnamese

Extension Info & Metadata

Status

Removed

Version

0.1.9.4

Size

14.22 MB

Rating

3.7/5

Reviews

Users

10,000

Type

Extension

Updated

Jul 24, 2024

Publisher Contextual Analysis

Author: https://webparanoid.comView Profile
Privacy: Privacy Policy
Country: GB
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Address: Unit 64002, Second Floor, 6 Market Place London W1W 8AF GB
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

10,000

Secure Shopping, Child Protection, Block Adult sites, Casino, and Dangerous Sites

The most advanced tool to block all types of dangerous sites including fake shops, phishing, and scam sites. Don't want to think every time is a site is safe or not, constantly check if it is fraudulent? We can do it for you. The Paranoid Web Extension checks every site you come across from an advertisement, email, or link from a friend or a colleague whose account may have been compromised. The extension was created to protect both new network users and experienced ones because not everyone can notice the substitution of a letter in the domain or analyze the site's reputation. Sometimes it is enough for hackers to create a fake financial site on a different domain zone (example: paypall.website ) and most of the users will simply ignore this and leave their account in the hands of scammers. Don't be afraid to shop on unfamiliar sites. We will alert you at the slightest hint of fraud. Paranoid Web Extension also blocks adult and gambling sites, casinos, etc. Protect yourself and your family. Installation and configuration take less than 3 minutes.

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

No change in user count

Compared to 3 months ago

17 versions released in this period

Rating Count

Total: 1 ratings

Average Rating

Current: 5.00 / 5.0

Item	Type	Severity	Description
<all_urls>	Host	Critical	Broad host access — the extension can read/modify content on every website.
Broad Host Permissions	Risk Factor	High	This extension has broad host permissions allowing it to access many or all websites.
Broad Content Script Access	Risk Factor	High	This extension can inject scripts into any website.
tabs	Permission	Medium	This permission enables tab management and monitoring. Rated Medium because it can track open tabs, access tab metadata, and monitor user browsing patterns.
activeTab	Permission	Medium	This permission grants temporary access to the current tab. Rated Medium because it can access current page content when invoked, though limited to user-initiated actions.
storage	Permission	Medium	This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
unlimitedStorage	Permission	Medium	This permission removes storage quota restrictions. Rated Medium because it can store large amounts of user data without limits, potentially impacting browser performance and storing extensive tracking data.
http://*/	Host	Medium	Host permission — access limited to this URL pattern.
https://*/	Host	Medium	Host permission — access limited to this URL pattern.

By severity

Critical4

High5

Medium1

Low0

Versions scanned

Showing 1 of 25 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
0.1.9.1 Code review	10

Extension Version	Code Review Findings
0.1.9.1	10

Files with findings

3 distinct paths — top paths by unique finding count:

js/background.js6
js/content-script.js3
detectnotification.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	critical	js/content-script.js (line 1162)	The extension polls every 3 seconds watching all `<input>` elements for payment-card attribute names (`cc-number`, `cardnumber`, `cvv`, `cvv2`, etc.). The moment a matching field is found it transmits the entire visib…	0.1.9.1
2	Data Exfiltration	critical	js/background.js (line 4863)	This `FullReport` function serialises the user's persistent tracking ID (`ParanoidIdMd5`), a screenshot (base64 PNG), and the full visible page text, then exfiltrates them via a POST to `api.webparanoid.com/report`. I…	0.1.9.1
3	Tracking	critical	js/background.js (line 5135)	For every page load on every site, the extension assembles a fingerprinting payload that includes the full URL (`r.full`), user tracking ID, browser locale, page title, an MD5 hash of the favicon image, a structural "…	0.1.9.1
4	Unauthorized Data Collection	critical	js/background.js (line 5074)	The extension invokes `chrome.tabs.captureVisibleTab` to silently take a PNG screenshot of the active tab, then calls `GetVisibleText` to retrieve the full body text of the page. Both the screenshot (as a base64 data …	0.1.9.1
5	Data Exfiltration	high	js/content-script.js (line 1455)	In response to the `GetVisibleText` message sent by the background script (triggered after taking a tab screenshot), the content script returns the complete `body.innerText` of the current page to the background. This…	0.1.9.1
6	Data Exfiltration	high	js/background.js (line 4881)	After scanning up to 20 images per page with a local TensorFlow/Keras model (`model/model.json`) for adult content classification, the extension POSTs the domain hostname along with the persistent user ID to `api.webp…	0.1.9.1
7	Privilege Escalation	high	js/background.js (line 563)	The background script can silently close the user's active tab and open a replacement tab without any warning dialog, triggered when the remote API classifies a visited URL as suspicious. Since the blocklist is fetche…	0.1.9.1
8	Tracking	high	js/background.js (line 5533)	On first run the extension contacts `api.webparanoid.com/user2` which returns a server-assigned tracking token stored as `ParanoidIdMd5`; if the request fails a hardcoded fallback MD5 is used. This token is then inclu…	0.1.9.1
9	Unauthorized Data Collection	high	js/content-script.js (line 1435)	The function reads the complete raw `document.body.innerHTML` and applies a regex to extract all email address-shaped strings. While the function only returns a boolean flag (does the page contain an email matching th…	0.1.9.1
10	Code Injection	medium	detectnotification.js (line 1)	This web-accessible script (declared in `web_accessible_resources` matching `<all_urls>`) monkey-patches `Notification.requestPermission` on every page, injecting a hidden `<input>` element into `document.body.innerHT…	0.1.9.1

URLs

IPv4

131

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.


www.w3.org	/2000/svg	http://www.w3.org/2000/svg
fonts.gstatic.com	/s/pacifico/v12/FwZY7-Qmy14u9lezJ-6H6MmBp0u-.woff2	https://fonts.gstatic.com/s/pacifico/v12/FwZY7-Qmy14u9lezJ-6H6MmBp0u-.woff2
craftpip.github.io	/jquery-confirm/	http://craftpip.github.io/jquery-confirm/
github.com	/craftpip/jquery-confirm/blob/master/LICENSE	https://github.com/craftpip/jquery-confirm/blob/master/LICENSE
fonts.googleapis.com	/css2	https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,300;0,400;0,600;0,700;1,300&display=swap
api.webparanoid.com	/pixel	https://api.webparanoid.com/pixel
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
webparanoid.com	/en/check-website/	https://webparanoid.com/en/check-website/
www.facebook.com	/ParanoidWebExtension	https://www.facebook.com/ParanoidWebExtension
twitter.com	/paranoid_web	https://twitter.com/paranoid_web

Showing 1 to 10 of 50 rows

Rows per page:

Gain full insight into all external connections.

Upgrade for full visibility.


7.34.74.56	IPv4	-
2.15.4.4	IPv4	-
38.36.4.4	IPv4	-
1.7.43.43	IPv4	-
36.12.55.12	IPv4	-
35.12.54.12	IPv4	-
16.9.12.53	IPv4	-
14.22.13.48	IPv4	-
1.62.12.4	IPv4	-
3.35.94.96	IPv4	-
15.46.62.9	IPv4	-
2.12.4.28	IPv4	-
56.45.34.31	IPv4	-
17.16.32.35	IPv4	-
2.1.38.24	IPv4	-
28.1.54.22	IPv4	-
25.14.48.3	IPv4	-
16.18.36.32	IPv4	-
1.82.8.36	IPv4	-
2.5.73.24	IPv4	-
24.23.45.41	IPv4	-
1.25.93.44	IPv4	-
9.31.22.15	IPv4	-
29.4.55.8	IPv4	-
1.22.24.37	IPv4	-
15.37.25.72	IPv4	-
6.12.71.12	IPv4	-
73.8.7.44	IPv4	-
42.45.8.93	IPv4	-
1.45.2.3	IPv4	-
21.4.38.81	IPv4	-
1.24.15.44	IPv4	-
1.45.11.45	IPv4	-
38.1.72.23	IPv4	-
1.67.72.24	IPv4	-
12.46.22.65	IPv4	-
1.2.87.87	IPv4	-
16.16.26.38	IPv4	-
53.81.86.86	IPv4	-
21.42.4.97	IPv4	-
9.36.4.66	IPv4	-
33.7.33.95	IPv4	-
37.18.75.32	IPv4	-
4.83.84.7	IPv4	-
2.56.3.72	IPv4	-
32.34.96.9	IPv4	-
1.12.2.23	IPv4	-
3.63.2.51	IPv4	-
35.15.54.18	IPv4	-
4.74.8.64	IPv4	-
41.25.83.49	IPv4	-
3.37.2.43	IPv4	-
22.42.5.8	IPv4	-
1.95.93.74	IPv4	-
2.56.36.76	IPv4	-
15.12.3.21	IPv4	-
1.67.8.6	IPv4	-
1.4.46.42	IPv4	-
5.79.17.38	IPv4	-
4.33.58.6	IPv4	-
15.28.19.61	IPv4	-
45.21.84.53	IPv4	-
1.12.94.43	IPv4	-
1.77.1.23	IPv4	-
15.48.15.73	IPv4	-
48.13.79.79	IPv4	-
1.68.96.96	IPv4	-
48.14.8.8	IPv4	-
1.74.95.95	IPv4	-
4.14.74.4	IPv4	-
22.16.48.24	IPv4	-
56.18.74.74	IPv4	-
25.55.74.74	IPv4	-
10.41.57.22	IPv4	-
1.55.56.22	IPv4	-
1.76.26.61	IPv4	-
16.2.13.17	IPv4	-
1.23.17.47	IPv4	-
1.8.42.27	IPv4	-
2.3.42.43	IPv4	-
3.14.6.15	IPv4	-
1.35.14.52	IPv4	-
42.3.8.74	IPv4	-
36.44.7.82	IPv4	-
43.24.79.68	IPv4	-
36.44.52.85	IPv4	-
1.58.55.57	IPv4	-
1.82.91.94	IPv4	-
1.58.85.88	IPv4	-
1.47.87.8	IPv4	-
19.45.27.94	IPv4	-
2.13.96.96	IPv4	-
2.1.46.13	IPv4	-
2.1.46.12	IPv4	-
1.58.34.94	IPv4	-
5.4.62.62	IPv4	-
7.24.72.72	IPv4	-
17.75.73.73	IPv4	-
18.66.7.7	IPv4	-
8.79.7.7	IPv4	-
22.56.91.91	IPv4	-
1.7.95.95	IPv4	-
44.73.48.48	IPv4	-
28.35.6.6	IPv4	-
23.18.5.3	IPv4	-
26.12.63.1	IPv4	-
23.15.5.38	IPv4	-
1.85.63.5	IPv4	-
4.3.75.66	IPv4	-
69.8.3.3	IPv4	-
1.4.3.7	IPv4	-
5.3.8.8	IPv4	-
1.4.2.5	IPv4	-
5.4.8.8	IPv4	-
13.8.2.5	IPv4	-
13.7.2.4	IPv4	-
13.7.2.5	IPv4	-
13.8.3.5	IPv4	-
5.3.8.7	IPv4	-
6.3.33.68	IPv4	-
13.13.23.23	IPv4	-
1.84.17.75	IPv4	-
2.4.37.81	IPv4	-
3.17.11.27	IPv4	-
2.54.25.81	IPv4	-
2.25.5.5	IPv4	-
2.152.242.63	IPv4	-
127.0.0.1	IPv4	-
5.4.4.6	IPv4	-
0.1.9.4	IPv4	-
0.1.9.3	IPv4	-

Showing 1 to 131 of 140 rows

Rows per page:

3.9 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

there needs to be a way to allow some sites that you are blocking one site especially is Temu.com. while some people may have had a problem with the site i have ordered from them many times and never had a problem with them. i would like to be able to mark it as a safe site and not have to deal with it being blocked all the time.

Gandalf Mithrandir·14 Sept 2024

It does pick up some scam sites. I am sure it makes mistakes and alerts some non scam sites. It did make my chrome very slow though. Especially YouTube, it took almost 2 minutes to load a YouTube page, every page. So had to disable it. I almost got scammed though and after installing this extension, I realised I could have saved myself the stress knowing it was a scam website.

Christopher Steenkamp·25 Jul 2024

Version	Size	Is Malicious	Findings	Permhash
0.1.9.3 Latest	14.19 MB	Malicious	—	206327c821de23397fa3bf07c35dc6e0da40888e32a431a579305311a003bc77
0.1.9.2	14.15 MB	Malicious	—	206327c821de23397fa3bf07c35dc6e0da40888e32a431a579305311a003bc77
0.1.9.1	14.15 MB	Malicious	10	206327c821de23397fa3bf07c35dc6e0da40888e32a431a579305311a003bc77
0.1.8.4	18.86 MB	Malicious	—	82d85f80d3f8cd12b84e57133d7709dae8ed9273878fbfd77d041fbf116c1965
0.1.8.3	18.85 MB	Malicious	—	82d85f80d3f8cd12b84e57133d7709dae8ed9273878fbfd77d041fbf116c1965
0.1.8.2	18.85 MB	Malicious	—	82d85f80d3f8cd12b84e57133d7709dae8ed9273878fbfd77d041fbf116c1965
0.1.8.1	18.68 MB	Malicious	—	82d85f80d3f8cd12b84e57133d7709dae8ed9273878fbfd77d041fbf116c1965
0.1.8	18.68 MB	Malicious	—	82d85f80d3f8cd12b84e57133d7709dae8ed9273878fbfd77d041fbf116c1965
0.1.7.9	18.68 MB	Malicious	—	82d85f80d3f8cd12b84e57133d7709dae8ed9273878fbfd77d041fbf116c1965
0.1.7.8	18.68 MB	Malicious	—	82d85f80d3f8cd12b84e57133d7709dae8ed9273878fbfd77d041fbf116c1965

Showing 1 to 10 of 30 rows

Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

Security Alert: Confirmed Malware

Paranoid Web Extension

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Manifest File Security Analysis

Code Review Findings Summary Across 25 Versions10

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating