Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: StopAds

CRITICAL RISKRemoved from Chrome Web Store

StopAds

ID: khnleagcghdbpphacgjjkcoceilngecl

Could be malicious

Extension Info & Metadata

Status

Removed

Version

1.3.10

Size

0.34 MB

Rating

4.5/5

Reviews

Users

221,987

Type

Extension

Updated

Nov 8, 2020

Publisher Contextual Analysis

Author: Sonia DutyView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

221,987

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Block all kinds of ads. Permanently

Stopads features: ✰ Ad blocking Stopads blocks all kinds of ads - banners, popups, video ads, etc. ✰ Easy setup It’s ready after install. No need for adding filters manually, disabling “acceptable ads”. ✰ Whitelist Use the extension button in the toolbar to add a site to the whitelist.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High3

Medium3

Low0

Versions scanned

Showing 2 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.3.10 Code review	4
1.3.9 Code review	5

Extension Version	Code Review Findings
1.3.10	4
1.3.9	5

Files with findings

4 distinct paths — top paths by unique finding count:

bg.js5
popup.html2
content.js1
subscriptions.xml1

S.No.	Category	Severity	File	Summary	Found in Version
1	Network Interception	critical	bg.js (line 6)	All critical filter list endpoints (acceptable ads exceptions, privacy exceptions, anti-adblock bypass filters) and the notification polling URL have been replaced with operator-controlled domains (rules.easyadblocker…	1.3.9
2	Network Interception	critical	subscriptions.xml (line 3)	All 23 filter subscriptions (EasyList, EasyPrivacy, Fanboy Social, and language-specific lists) are proxied through rules.easyadblocker.com rather than fetched from their legitimate sources (easylist.to, etc.). The op…	1.3.9
3	Remote Code Loading	critical	bg.js (line 233)	This code obfuscates and injects a remote Google Tag Manager script into the extension background page by deriving the base URL from the manifest CSP and dynamically appending a new element. Loading remotely hosted ex…	1.3.10
4	Code Injection	high	content.js (line 1291)	The content script injects extension-generated JavaScript directly into every HTML page using a Blob URL script element. That breaks out of the normal isolated-world boundary and gives the extension code direct access…	1.3.10
5	Other	high	popup.html (line 1)	The extension popup loads an external stylesheet from http://allfont.ru over unencrypted HTTP with no Subresource Integrity (SRI) hash. This makes the popup vulnerable to man-in-the-middle attacks where an attacker on…	1.3.9
6	Remote Code Loading	high	bg.js (line 6)	The extension periodically polls cdn.easyadblocker.com/notification.json and the notification response can contain link arrays that trigger browser.tabs.create() calls, forcing new tabs to open in the user's browser. …	1.3.9
7	Network Interception	medium	bg.js (line 10637)	This listener inspects essentially all subresource HTTP(S)/WebSocket requests and can cancel them before they are sent. Broad request interception is expected in an ad blocker, but it is also a high-risk surveillance …	1.3.10
8	Remote Code Loading	medium	popup.html (line 1)	The popup loads multiple remote stylesheet resources, including one over plain HTTP from `allfont.ru`. Pulling UI resources from external origins introduces tracking exposure and creates a supply-chain risk where thir…	1.3.10
9	Unauthorized Data Collection	medium	bg.js (line 4)	The filter list downloader makes background XMLHttpRequests (marked mozBackgroundRequest=true to hide from browser UI) to fetch filter lists from easyadblocker.com. These requests bypass browser caching and are valida…	1.3.9

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


rules.easyadblocker.com	/easylist.txt	https://rules.easyadblocker.com/easylist.txt
easylist.to	-	https://easylist.to/
rules.easyadblocker.com	/abpindo+easylist.txt	https://rules.easyadblocker.com/abpindo+easylist.txt
abpindo.blogspot.com	-	http://abpindo.blogspot.com/
rules.easyadblocker.com	/abpvn+easylist.txt	https://rules.easyadblocker.com/abpvn+easylist.txt
abpvn.com	-	http://abpvn.com/
rules.easyadblocker.com	/bulgarian_list+easylist.txt	https://rules.easyadblocker.com/bulgarian_list+easylist.txt
stanev.org	/abp/	http://stanev.org/abp/
rules.easyadblocker.com	/easylistchina+easylist.txt	https://rules.easyadblocker.com/easylistchina+easylist.txt
abpchina.org	/forum/	http://abpchina.org/forum/

Showing 1 to 10 of 70 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

3.3 out of 5 · 3 most recent reviews

Text reviews

Positive

Negative

Blocks no kinds of ads on any website ever

Jaz·16 Jan 2021

100k+ user and 2 reviews bruh lemme raise the rating

skykiller509·4 Jan 2021

no es malo pero me sirve :v se acabo el comentario

andres felipe ordoñez mera EDAD:14·17 Nov 2020

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

StopAds

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions9

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews