Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Star ad blocker

CRITICAL RISKRemoved from Chrome Web Store

Star ad blocker

ID: nainffcnjbdmiiikacadkhnbnjadcmbn

Could be malicious

Supported Languages

🇧🇩Bengali

🇧🇷Brazilian Portuguese

🇬🇧British English

🇧🇬Bulgarian

🇪🇸Catalan

🇨🇳Chinese (Simplified)

🇹🇼Chinese (Traditional)

🇭🇷Croatian

🇨🇿Czech

🇩🇰Danish

🇳🇱Dutch

🇺🇸English

🇪🇪Estonian

🇵🇭Filipino

🇫🇮Finnish

🇫🇷French

🇩🇪German

🇬🇷Greek

🇮🇳Gujarati

🇮🇳Hindi

🇭🇺Hungarian

🇮🇩Indonesian

🇮🇹Italian

🇯🇵Japanese

🇰🇷Korean

🇲🇽Latin American Spanish

🇱🇻Latvian

🇱🇹Lithuanian

🇲🇾Malay

🇮🇳Malayalam

🇮🇳Marathi

🇳🇴Norwegian

🇵🇱Polish

🇵🇹Portuguese

🇷🇴Romanian

🇷🇺Russian

🇷🇸Serbian

🇸🇰Slovak

🇸🇮Slovenian

🇪🇸Spanish

🇸🇪Swedish

🇮🇳Tamil

🇮🇳Telugu

🇹🇭Thai

🇹🇷Turkish

🇺🇦Ukrainian

🇺🇸US English

🇻🇳Vietnamese

Extension Info & Metadata

Status

Removed

Version

2.4.2

Size

3.19 MB

Rating

3.0/5

Reviews

Users

200,000

Type

Extension

Updated

Aug 23, 2021

Publisher Contextual Analysis

Author: Liam SantoroView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

200,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Extremely easy-to-use ad blocker. Defaults to the maximum efficiency.

Star ad blocker blocks ads across the web - banners, video ads, pre-roll, context ads, popup ads. Features: ✰ Performant ad-blocking functionality ✰ Good defaults: adblocking filters are enabled using your geographical location ✰ Whitelist: if you have issues you can disable the ad blocker on some page Please note: running multiple ad blockers in a single browser lead to increased consumption of resources, can drain your battery, etc. Please run only one ad blocker.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical1

High7

Medium0

Low0

Versions scanned

Showing 2 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.4.2 Code review	4
2.4.1 Code review	4

Extension Version	Code Review Findings
2.4.2	4
2.4.1	4

Files with findings

3 distinct paths — top paths by unique finding count:

js/background.js6
assets/thirdparties/ublock/privacy.txt1
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Tracking	critical	assets/thirdparties/ublock/privacy.txt (line 46)	The extension's own bundled EasyPrivacy and uBlock privacy filter lists explicitly block `google-analytics.com/analytics.js` (redirecting it to a noop stub) and the PGL Yoyo hosts list maps `google-analytics.com` to `…	2.4.1
2	Network Interception	high	js/background.js (line 14482)	At startup the extension contacts a remote server, includes its own extension ID in the URL, and downloads whitelist directives. Those directives are later applied as trusted-site exceptions, allowing the operator to …	2.4.2
3	Network Interception	high	js/background.js (line 5017)	The extension registers a remotely hosted whitelist.json from onlinesly.com as a built-in asset source, again keyed by the extension ID. This gives the publisher server-side control over exemption rules for a webReque…	2.4.2
4	Network Interception	high	js/background.js (line 12140)	Downloaded or externally supplied trustedSiteDirectives are copied directly into the default net whitelist and persisted to storage. In a blocking extension with <all_urls> access, this means remotely supplied configu…	2.4.2
5	Remote Code Loading	high	js/background.js (line 1)	The background page initializes Google Analytics and then injects a remotely hosted script into the privileged extension context. Loading third-party JavaScript from the network inside an MV2 background page is a stro…	2.4.2
6	Remote Code Loading	high	manifest.json (line 1)	The manifest's Content Security Policy was intentionally weakened to explicitly whitelist `https://www.google-analytics.com` as an allowed external script source. This is the enabler for the covert analytics loading i…	2.4.1
7	Remote Code Loading	high	js/background.js (line 1)	The background script dynamically fetches and executes analytics.js from Google's servers at runtime, rather than bundling any local copy. This means the code running inside the privileged extension background page is…	2.4.1
8	Tracking	high	js/background.js (line 1)	The very first line of the persistent background script initializes Google Analytics with property ID 'UA-199512516-1', bypasses Chrome's protocol restriction via `ga('set','checkProtocolTask',null)` (a known techniqu…	2.4.1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

907

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


raw.githubusercontent.com	/gorhill/uBlock/master/assets/assets.json	https://raw.githubusercontent.com/gorhill/uBlock/master/assets/assets.json
gitcdn.xyz	/repo/gorhill/uBlock/master/assets/assets.json	https://gitcdn.xyz/repo/gorhill/uBlock/master/assets/assets.json
cdn.jsdelivr.net	/gh/gorhill/uBlock@master/assets/assets.json	https://cdn.jsdelivr.net/gh/gorhill/uBlock@master/assets/assets.json
cdn.statically.io	/gh/gorhill/uBlock/master/assets/assets.json	https://cdn.statically.io/gh/gorhill/uBlock/master/assets/assets.json
combinatronics.io	/gorhill/uBlock/master/assets/assets.json	https://combinatronics.io/gorhill/uBlock/master/assets/assets.json
publicsuffix.org	/list/public_suffix_list.dat	https://publicsuffix.org/list/public_suffix_list.dat
gitcdn.xyz	/repo/publicsuffix/list/master/public_suffix_list.dat	https://gitcdn.xyz/repo/publicsuffix/list/master/public_suffix_list.dat
raw.githubusercontent.com	/uBlockOrigin/uAssets/master/filters/badlists.txt	https://raw.githubusercontent.com/uBlockOrigin/uAssets/master/filters/badlists.txt
gitcdn.xyz	/repo/uBlockOrigin/uAssets/master/filters/badlists.txt	https://gitcdn.xyz/repo/uBlockOrigin/uAssets/master/filters/badlists.txt
cdn.jsdelivr.net	/gh/uBlockOrigin/uAssets@master/filters/badlists.txt	https://cdn.jsdelivr.net/gh/uBlockOrigin/uAssets@master/filters/badlists.txt

Showing 1 to 10 of 910 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


34.66.206.188	IPv4	-
35.224.227.218	IPv4	-
35.232.188.118	IPv4	-
51.77.227.100	IPv4	-
51.77.227.101	IPv4	-
51.77.227.102	IPv4	-
51.77.227.103	IPv4	-
51.77.227.96	IPv4	-
51.77.227.97	IPv4	-
51.77.227.98	IPv4	-
51.77.227.99	IPv4	-
51.89.187.136	IPv4	-
51.89.187.137	IPv4	-
51.89.187.138	IPv4	-
51.89.187.139	IPv4	-
51.89.187.140	IPv4	-
51.89.187.141	IPv4	-
51.89.187.142	IPv4	-
51.89.187.143	IPv4	-
167.206.10.148	IPv4	-
142.91.159.107	IPv4	-
185.147.34.126	IPv4	-
5.45.79.15	IPv4	-
146.59.211.227	IPv4	-
192.168.0.1	IPv4	-
192.168.1.1	IPv4	-
185.165.169.108	IPv4	-
185.193.38.148	IPv4	-
35.194.26.233	IPv4	-
35.239.57.233	IPv4	-
45.32.105.134	IPv4	-
77.162.125.199	IPv4	-
193.197.158.209	IPv4	-
212.95.32.75	IPv4	-
180.76.2.18	IPv4	-
109.169.66.161	IPv4	-
216.18.176.4	IPv4	-
78.46.19.203	IPv4	-
120.132.57.41	IPv4	-
199.116.177.156	IPv4	-
127.0.0.1	IPv4	-
85.237.86.50	IPv4	-
77.91.202.130	IPv4	-

Showing 1 to 43 of 50 rows

Rows per page:

1.0 out of 5 · 1 most recent review

Text reviews

Positive

Negative

It gave virus

Bryce Wagner·31 Aug 2021

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Star ad blocker

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions8

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews