Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Поиск Startpage Media

CRITICAL RISKRemoved from Chrome Web Store

Поиск Startpage Media

ID: ddadgcdmddljmpkpinkalnepdepplpkj

Could be malicious

Supported Languages

🇷🇺Russian

Extension Info & Metadata

Status

Removed

Version

0.1.4

Size

0.01 MB

Rating

2.5/5

Reviews

Users

400,000

Type

Extension

Updated

Dec 10, 2018

Publisher Contextual Analysis

Author: http://startpage.mediaView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

461,319

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Информация всегда под рукой! Ищите и находите все необходимое в интернете с быстрым поиском от startpage.media. Расширение…

Информация всегда под рукой! Ищите и находите все необходимое в интернете с быстрым поиском от startpage.media. Расширение обеспечит актуальную и точную выдачу по всем поисковым запросам. С поиском startpage.media, интернет становится доступнее, а информация ближе.

User Growth

Showing data from Jan 01, 2022 to Sep 22, 2022

Versions

No change in user count

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 37 ratings

Average Rating

Current: 2.51 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High3

Medium1

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
0.1.4 Code review	6

Extension Version	Code Review Findings
0.1.4	6

Files with findings

2 distinct paths — top paths by unique finding count:

js/background.js5
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Privilege Escalation	critical	js/background.js (line 42)	The extension connects to a native host application (`org.infosoftware.ext_host`) via `nativeMessaging` and communicates with two distinct domains: `startpage.media` and `e-tab.ru`. The native host connection bypasses…	0.1.4
2	Privilege Escalation	critical	js/background.js (line 86)	On installation, the extension immediately opens a persistent native messaging channel to `org.infosoftware.ext_host` and sends the install payload to a native application. The response from the native host contains a…	0.1.4
3	Tracking	high	js/background.js (line 113)	The extension compares a UTM timestamp from the native installer with one from a remote server (`http://e-tab.ru/activity/utm/fromcookie`) and selects which GUID and UTM attribution string to use. This is a covert cro…	0.1.4
4	Unauthorized Data Collection	high	js/background.js (line 166)	Three network calls are made on install: a credentialed GET to `http://e-tab.ru/activity/utm/fromcookie` (reads cookies from that domain), a POST to `http://e-tab.ru/activity/newtab/install` with an MD5-checksummed pa…	0.1.4
5	Unauthorized Data Collection	high	manifest.json (line 31)	The extension forcibly overrides the browser's default search engine to `startpage.media` using `is_default: true`, serving all search queries through that domain. All search terms are logged by `startpage.media` alon…	0.1.4
6	Tracking	medium	js/background.js (line 75)	The extension sets a custom uninstall URL pointing to `http://startpage.media` that includes the user's persistent GUID (`client_id`). When a user uninstalls the extension, this URL is silently pinged, notifying the o…	0.1.4

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/xap/1.0/mm/	http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com	/xap/1.0/sType/ResourceRef	http://ns.adobe.com/xap/1.0/sType/ResourceRef#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
startpage.media	-	http://startpage.media
e-tab.ru	/activity/newtab/install	http://e-tab.ru/activity/newtab/install
e-tab.ru	/activity/utm/fromcookie	http://e-tab.ru/activity/utm/fromcookie
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
startpage.media	/*	http://startpage.media/*
e-tab.ru	/*	http://e-tab.ru/*

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

1.4 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Вирус

НВ

Наталья Воронецкая·13 May 2019

Невозможно удалить . Избегайте !

АЛ

Агасфер Лукич Громов·15 Mar 2018

вирус

АП

Андрей Предложкин·17 Feb 2018

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Поиск Startpage Media

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version6

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating