Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: PP谷歌访问助手-为国出征-国庆版

CRITICAL RISKRemoved from Chrome Web Store

PP谷歌访问助手-为国出征-国庆版

ID: kahndhhhcnignmbbpiobmdlgjhgfkfil

Could be malicious

Supported Languages

🇨🇳Chinese (Simplified)

Extension Info & Metadata

Status

Removed

Version

4.1

Size

0.14 MB

Rating

4.6/5

Reviews

747

Users

60,000

Type

Extension

Updated

Apr 10, 2021

Publisher Contextual Analysis

Trusted

Author: http://ppgoogle.comView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

60,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

帮助访问被封锁的谷歌和旗下网站。代理服务器稳定，VPN原理，HTTPS级别加密，确保通信安全。

3.9版更新：修复了部分bug。 3.8版更新：修复了部分bug，增加扩展冲突提示。 3.7版更新：修复了部分bug，新增服务器支持，开通更多网站加速服务。 3.1版更新：刷新更换服务器的bug问题修复了，支持20台服务器随机更换。 3.0版更新：庆祝新中国成立70周年！祝福祖国！新发国庆版。免费，无限时，最简单易用的外部谷歌访问助手。 1 您可以从我们的谷歌访问助手中获得什么？可以访问Google.com站以及Google™旗下常见的网站和服务。 2 这个扩展收费吗？访问助手中包含的所有功能都是免费的！还有无限时地使用Google™访问服务。 3 和VPN什么区别？功能类似，内部用了pac代理配置的代理服务器，不过只能访问Google™网站。如果临时上不了Google，可以点右上角图标然后刷新服务器。或者请过一段时间再试。更多信息可以访问我们官网: http://www.ppgoogle.com

User Growth

Showing data from Jan 01, 2022 to Jul 09, 2022

Versions

No change in user count

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 747 ratings

Average Rating

Current: 4.64 / 5.0-0.02

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical1

High4

Medium1

Low0

Versions scanned

Showing 1 of 6 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
3.10 Code review	6

Extension Version	Code Review Findings
3.10	6

Files with findings

4 distinct paths — top paths by unique finding count:

js/system.js3
js/background.js1
js/global.js1
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Network Interception	critical	js/system.js (line 8)	The proxy server IP (stored in n.pw.ip) is fetched from an unencrypted HTTP endpoint at ppgoogle.net. The response is immediately parsed and passed to U() which configures Chrome's system-wide proxy. A network attacke…	3.10
2	Code Injection	high	js/global.js (line 32)	`Function(e)()` is semantically identical to `eval(e)`. When jQuery.parseJSON throws on a string, the raw string is executed as JavaScript in the background page's privileged context. background.js calls this function…	3.10
3	Network Interception	high	js/system.js (line 380)	The remotely-fetched proxy IP is interpolated directly into a PAC script string and applied as Chrome's system proxy. All 60,000 users' Google traffic (Search, Gmail, YouTube, Drive, Google Docs) passes through ppgoog…	3.10
4	Tracking	high	js/background.js (line 116)	On first install the extension dynamically loads fingerprint2.js and generates a stable hardware-level fingerprint (canvas, WebGL, fonts, plugins, screen resolution, timezone). This fingerprint becomes the persistent …	3.10
5	Unauthorized Data Collection	high	js/system.js (line 115)	A blocking webRequest listener fires on every HTTP and HTTPS request across all tabs and all URLs. It extracts the domain of every request and builds an in-memory parent-child domain graph keyed by tab ID. This system…	3.10
6	Other	medium	manifest.json (line 4)	The extension's Content Security Policy explicitly includes `'unsafe-eval'`, disabling the browser's standard protection against dynamic code execution in the extension context. This is required to support the `Functi…	3.10

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
ns.adobe.com	/xap/1.0/mm/	http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com	/xap/1.0/sType/ResourceRef	http://ns.adobe.com/xap/1.0/sType/ResourceRef#
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
apis.google.com	-	https://apis.google.com
ssl.google-analytics.com	-	https://ssl.google-analytics.com
*.yahoo.com	-	https://*.yahoo.com
suggestqueries.google.com	-	https://suggestqueries.google.com
www.gstatic.com	-	https://www.gstatic.com

Showing 1 to 10 of 40 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

3.3 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

目前还能用的不��了

范

范波·13 May 2022

目前还能用的不多了

范

范波·13 May 2022

yongbuliao

yi du·2 May 2022

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

PP谷歌访问助手-为国出征-国庆版

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 6 Versions6

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating