Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Yesil adblock

CRITICAL RISKRemoved from Chrome Web Store

Yesil adblock

ID: cjegcaiafliiomjbcplcfekkjjeppkkk

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

1.2.0

Size

13.34 MB

Rating

5.0/5

Reviews

Users

175,820

Type

Extension

Updated

Feb 15, 2023

Publisher Contextual Analysis

Trusted

Author: Sheldon NormanView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

175,820

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Enrich your browsing experience with the proper adblock tool

Yesil Adblock is a powerful and efficient Chrome extension that enhances your online experience by blocking unwanted ads. With its advanced technology and user-friendly interface, it ensures a smooth and seamless browsing experience without the annoyance of pop-ups, banners, and other types of disruptive ads. Whether you're reading an article, shopping online, or watching a video, Yesil Adblock has you covered, keeping your screen free from any distracting advertisements. Get the proper adblock tool and enrich your browsing experience today! Yesil Adblock also protects your privacy by blocking trackers and malicious websites, giving you peace of mind while browsing the web. This extension is lightweight and easy to use, with no complicated settings or configurations. Simply install it and enjoy a cleaner, faster, and safer online experience. Say goodbye to intrusive ads and hello to a more enjoyable browsing experience with Yesil Adblock. Upgrade your online experience today by installing this must-have Chrome extension! We collect data regarding your browsing usage, specifically the domains you browse. For more information regarding our data collection, we urge you to review our privacy policy before you install our add-on, available here: https://docs.google.com/document/d/e/2PACX-1vQEZsNECPxrFT144UL7eJ61E4YvYnfD9bhiQZxxgU-R2_uoCVx8S5AQHXw5PIfV99kIepS4-lDaMQG7/pub

User Growth

Showing data from Feb 16, 2023 to Jun 09, 2023

Versions

+17581900%(+175,819 users)

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 20 ratings

Average Rating

Current: 5.00 / 5.0+5.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High4

Medium1

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.2.0 Code review	7

Extension Version	Code Review Findings
1.2.0	7

Files with findings

3 distinct paths — top paths by unique finding count:

js/content.js5
html/consent-content.html1
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	js/content.js (line 4573)	This module collects the user's current page URL, referrer, and timestamp, encrypts the payload using NaCl sealed-box cryptography with a hardcoded server-side public key (AWa5LEhHFzCGbBflnEaBeMXEezfeoARX1SgHkuQKz1U=)…	1.2.0
2	Data Exfiltration	critical	js/content.js (line 4575)	This content script collects the full page URL, referrer, and timestamp from every top-level page and sends it to an external domain. Because the extension runs on all HTTP/HTTPS pages and performs the transmission fr…	1.2.0
3	Obfuscation	high	js/content.js (line 4580)	The extension uses `tweetnacl-sealedbox-js` with a hard-coded public key to encrypt telemetry before upload. Encrypting the payload is not inherently malicious, but here it clearly conceals the contents of the transmi…	1.2.0
4	Tracking	high	js/content.js (line 4588)	The fetch to zone1-services-cdn.com is made with credentials:include, meaning the browser automatically attaches all cookies for that domain to the request. Combined with the encrypted payload containing the extension…	1.2.0
5	Unauthorized Data Collection	high	html/consent-content.html (line 1)	The extension presents a deceptive consent dialog disguised as joining a 'contributor network for malware protection' — but what it actually does is authorize covert transmission of the user's full browsing history (e…	1.2.0
6	Unauthorized Data Collection	high	manifest.json (line 17)	The content script is configured to inject into every HTTP and HTTPS page (including all iframes via all_frames:true and about:blank pages via match_about_blank:true) at document_start — the earliest possible executio…	1.2.0
7	Obfuscation	medium	js/content.js (line 1)	The entire content.js is a heavily obfuscated Browserify bundle using systematically meaningless 1-2 character variable names throughout (gs, uk, qh, pf, ku, sg, KY, Qj, VW, aZ, yv, KO, etc.). The obfuscation is appli…	1.2.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

949

IPv4

232

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


rgqxbf.com	/mn9l17912/ilvpm003y/oln/786/vqu768kypc01r%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BDK	https://rgqxbf.com/mn9l17912/ilvpm003y/oln/786/vqu768kypc01r��K
videochart.net	/video[k	http://videochart.net/video[k
playvideolink.com	/video[k	http://playvideolink.com/video[k
220forum.ru	/askue_forum_500x100.html9%EF%BF%BD%EF%BF%BDh%EF%BF%BD	http://220forum.ru/askue_forum_500x100.html9��h�
http:	-	http://�P9��
static.videonow.ru	/v*/vn_module.jsinoprosport.ru%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD	https://static.videonow.ru/v*/vn_module.jsinoprosport.ru��
*.ru	/leftunit.pl	http://*.ru/leftunit.pl?�S��r�
v.*.com	/x	http://v.*.com/x?�X��:�
v.*.com	/vv	http://v.*.com/vv?
v.*.com	/v	http://v.*.com/v?hY��

Showing 1 to 10 of 950 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


78.46.107.144	IPv4	-
5.1.35.2	IPv4	-
5.45.126.35	IPv4	-
37.1.201.32	IPv4	-
37.1.217.113	IPv4	-
37.1.207.65	IPv4	-
37.220.36.15	IPv4	-
95.213.231.34	IPv4	-
95.211.125.226	IPv4	-
91.207.192.31	IPv4	-
88.85.77.92	IPv4	-
88.85.75.147	IPv4	-
78.140.149.216	IPv4	-
78.140.134.198	IPv4	-
77.247.178.41	IPv4	-
52.210.16.150	IPv4	-
37.220.26.137	IPv4	-
37.220.26.136	IPv4	-
37.220.26.135	IPv4	-
91.116.142.114	IPv4	-
187.6.64.32	IPv4	-
184.154.142.242	IPv4	-
200.72.40.46	IPv4	-
184.106.248.76	IPv4	-
88.150.149.92	IPv4	-
139.99.120.222	IPv4	-
149.56.24.226	IPv4	-
176.31.96.119	IPv4	-
46.105.62.117	IPv4	-
62.212.73.45	IPv4	-
213.206.98.70	IPv4	-
198.16.64.66	IPv4	-
90.63.192.161	IPv4	-
51.89.115.13	IPv4	-
51.195.115.102	IPv4	-
51.178.195.171	IPv4	-
5.45.79.15	IPv4	-
23.109.87.71	IPv4	-
23.109.82.74	IPv4	-
23.109.82.104	IPv4	-
23.109.248.1	IPv4	-
23.109.248.159	IPv4	-
23.109.248.149	IPv4	-
23.109.150.101	IPv4	-
203.195.121.193	IPv4	-
203.195.121.180	IPv4	-
203.195.121.105	IPv4	-
185.147.34.126	IPv4	-
176.31.68.242	IPv4	-
146.59.223.83	IPv4	-
143.244.184.39	IPv4	-
142.91.159.107	IPv4	-
167.206.10.148	IPv4	-
51.89.187.143	IPv4	-
51.89.187.142	IPv4	-
51.89.187.141	IPv4	-
51.89.187.140	IPv4	-
51.89.187.139	IPv4	-
51.89.187.138	IPv4	-
51.89.187.137	IPv4	-
51.89.187.136	IPv4	-
51.77.227.99	IPv4	-
51.77.227.98	IPv4	-
51.77.227.97	IPv4	-
51.77.227.96	IPv4	-
51.77.227.103	IPv4	-
51.77.227.102	IPv4	-
51.77.227.101	IPv4	-
51.77.227.100	IPv4	-
37.1.209.213	IPv4	-
23.109.87.101	IPv4	-
203.195.121.11	IPv4	-
167.99.31.227	IPv4	-
162.252.214.4	IPv4	-
23.109.87.42	IPv4	-
185.165.169.108	IPv4	-
34.70.28.179	IPv4	-
35.224.227.218	IPv4	-
35.232.188.118	IPv4	-
117.254.84.212	IPv4	-
173.249.49.204	IPv4	-
111.90.159.132	IPv4	-
111.90.150.149	IPv4	-
1.4.2.1	IPv4	-
158.69.120.31	IPv4	-
173.212.233.209	IPv4	-
185.145.131.204	IPv4	-
5.182.211.129	IPv4	-
38.242.198.170	IPv4	-
188.72.219.36	IPv4	-
111.75.255.103	IPv4	-
208.94.244.98	IPv4	-
208.94.244.100	IPv4	-
172.86.179.138	IPv4	-
75.125.41.29	IPv4	-
70.86.24.120	IPv4	-
61.164.108.184	IPv4	-
210.40.130.91	IPv4	-
182.150.59.104	IPv4	-
127.0.0.1	IPv4	-
120.132.57.41	IPv4	-
117.60.146.16	IPv4	-
115.28.114.149	IPv4	-
107.182.131.103	IPv4	-
61.10.2.86	IPv4	-
59.36.101.209	IPv4	-
58.218.200.135	IPv4	-
47.100.0.249	IPv4	-
23.91.3.114	IPv4	-
219.128.77.113	IPv4	-
202.102.26.253	IPv4	-
180.96.27.85	IPv4	-
174.123.15.43	IPv4	-
122.228.200.55	IPv4	-
121.43.114.38	IPv4	-
120.27.34.156	IPv4	-
115.29.46.146	IPv4	-
108.171.248.234	IPv4	-
107.172.176.197	IPv4	-
50.7.31.228	IPv4	-
60.190.139.164	IPv4	-
23.89.50.180	IPv4	-
23.244.43.212	IPv4	-
222.186.12.235	IPv4	-
221.204.213.222	IPv4	-
220.115.251.25	IPv4	-
216.172.154.226	IPv4	-
213.232.113.250	IPv4	-
211.167.105.131	IPv4	-
210.65.10.32	IPv4	-
180.76.171.28	IPv4	-
174.139.53.195	IPv4	-
172.121.4.252	IPv4	-
172.121.4.251	IPv4	-
164.155.185.254	IPv4	-
163.197.167.236	IPv4	-
163.197.136.33	IPv4	-
156.246.162.2	IPv4	-
156.232.37.2	IPv4	-
154.196.143.171	IPv4	-
146.148.85.61	IPv4	-
142.0.129.74	IPv4	-
137.175.69.92	IPv4	-
136.0.56.196	IPv4	-
134.73.54.252	IPv4	-
122.114.239.160	IPv4	-
121.40.25.88	IPv4	-
119.29.207.87	IPv4	-
107.187.122.172	IPv4	-
107.183.137.18	IPv4	-
107.165.206.26	IPv4	-
107.148.199.181	IPv4	-
103.21.91.144	IPv4	-
23.234.217.12	IPv4	-
23.234.217.11	IPv4	-
194.59.220.161	IPv4	-
121.204.246.13	IPv4	-
104.167.70.98	IPv4	-
199.180.100.185	IPv4	-
156.233.32.123	IPv4	-
23.224.89.2	IPv4	-
192.151.218.66	IPv4	-
77.91.202.130	IPv4	-
81.176.238.128	IPv4	-
199.19.203.46	IPv4	-
58.205.218.4	IPv4	-
79.125.117.123	IPv4	-
74.55.82.102	IPv4	-
72.172.88.25	IPv4	-
67.228.151.70	IPv4	-
66.228.52.30	IPv4	-
62.160.52.73	IPv4	-
216.18.184.18	IPv4	-
212.95.32.75	IPv4	-
212.227.100.108	IPv4	-
208.88.226.75	IPv4	-
195.10.245.55	IPv4	-
193.197.158.209	IPv4	-
180.76.2.18	IPv4	-
149.13.65.144	IPv4	-
110.93.143.144	IPv4	-
149.13.77.20	IPv4	-
88.198.13.8	IPv4	-
62.146.108.97	IPv4	-
213.133.100.18	IPv4	-
85.114.133.62	IPv4	-
2.0.77.57	IPv4	-
93.88.74.236	IPv4	-
5.45.86.39	IPv4	-
37.1.205.47	IPv4	-
37.1.206.95	IPv4	-
2.0.41.3	IPv4	-
2.1.48.27	IPv4	-
109.163.231.44	IPv4	-
85.114.138.56	IPv4	-
212.109.224.91	IPv4	-
2.0.37.32	IPv4	-
142.91.159.218	IPv4	-
162.215.254.42	IPv4	-
178.175.132.130	IPv4	-
188.165.178.248	IPv4	-
163.172.219.174	IPv4	-
2.2.67.3	IPv4	-
91.208.197.24	IPv4	-
38.242.199.52	IPv4	-
217.16.188.246	IPv4	-
157.245.202.123	IPv4	-
38.242.194.12	IPv4	-
91.208.197.115	IPv4	-
194.163.183.129	IPv4	-
206.189.151.55	IPv4	-
185.63.253.247	IPv4	-
91.230.121.24	IPv4	-
45.133.203.223	IPv4	-
190.115.18.20	IPv4	-
167.99.71.200	IPv4	-
109.236.92.205	IPv4	-
50.7.161.20	IPv4	-
3.1.1.1	IPv4	-
192.168.0.1	IPv4	-
192.168.1.1	IPv4	-
2.0.79.72	IPv4	-
61.160.236.52	IPv4	-
173.192.147.21	IPv4	-
2.0.51.38	IPv4	-
2.0.78.37	IPv4	-
2.0.32.38	IPv4	-
2.0.32.20	IPv4	-
2.0.4.38	IPv4	-
2.0.17.8	IPv4	-
1.2.3.4	IPv4	-
0.0.0.0	IPv4	-
3:1:11:10:7:8:13:12	IPv6	-
1:2:3:4:5:6:7:8	IPv6	-

Showing 1 to 234 of 240 rows

Rows per page:

5.0 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Yesil adblock

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version7

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews