Jump to content

How to find/stop address that keeps giving me multiple "Address has been blocked" notifications


Recommended Posts

My laptop (Lenovo Thinkpad Edge - with Windows 7 Home Premium [64-bit]) has been receiving multiple "Address has been blocked" notifications from ESET Internet Security. I'm not sure for how long its been going on.

Pictures of notifications attached.

Address (I purposefully put spaces between slashes): https: // s3.amazonaws.com / casge-js / 1d4bbf3f0bf70fccdd.js

The IP Address (found in the "Details") changes from 52.216.100.77 and 52.216.0.163, which google says are both associated to Amazon Technologies Inc.

What I've noticed is that it doesn't matter what site you're on, the notifications pop up in bunches (maximum I've seen is 46)

I'm not sure what do to next to find/remove this address and stop the notifications.

Capture.JPG

Capture2.JPG

Link to post
Share on other sites
  • Administrators

You didn't mention what browser you use. It appears to be a JS/Revizer that accesses the url. Try launching the browser without extensions / add-ons loaded. Also collect logs with ELC and provide me with the generated archive.

Link to post
Share on other sites
6 hours ago, Marcos said:

You didn't mention what browser you use. It appears to be a JS/Revizer that accesses the url. Try launching the browser without extensions / add-ons loaded. Also collect logs with ESET Log Collector and provide me with the generated archive.

I use Google Chrome. I've disabled all the extensions I use and haven't seen the "Address has been blocked" notification for the past hour or so - that looks promising :) .

I've attached the log collection zip folder, I wasn't sure if I was supposed to send certain files so I just attached the whole zip folder.

 

Link to post
Share on other sites
  • Administrators

The logs looked ok. Let's try enabling one extension at a time to find the one which is triggering the url block. We'd like to know what extension it is and get it for blacklisting.

Link to post
Share on other sites
6 hours ago, Marcos said:

The logs looked ok. Let's try enabling one extension at a time to find the one which is triggering the url block. We'd like to know what extension it is and get it for blacklisting.

I believe the extension causing the url block is "Cloud Convert" : https://chrome.google.com/webstore/detail/cloudconvert-convert-anyt/kdmjifkppcjphfoplcicglcfcpbdoibo?utm_source=chrome-ntp-icon

Only when enabled in chrome does this "Address has been blocked" notification pop up. The website itself (https://cloudconvert.com/) doesn't cause any issues, just having the chrome extension causes issues.

Capture.JPG

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...