norman.mobi ando ther notifications on mobile Eset

[PassingBy 5]

Hi everyone,

 

In recent times i have been witnessing an increase in notifications from Eset mobile, some of which bizarre because they pop up while the phone is in standby as i work at the PC.

The notification informs me of a threat in a site i am trying to open. But i am not interacting with the mobile at all.

The last one was today with a threat called norman.mobi

 

The previous ones in january with one called reza.mobi.

 

Once i remove the notification there is nothing i can do to see which webpage or else was originating the issue.

 

Does any of you have any clue?

 

Thanks in advance.

[Marcos 4,587]

Check the notification permissions in the privacy settings of your browser and make sure the website in question doesn't have notifications allowed. The website is already blocked so you shouldn't be able to open it in a browser neither on a PC nor mobile phone with ESET installed.

[PassingBy 5]

1 hour ago, Marcos said:

Check the notification permissions in the privacy settings of your browser and make sure the website in question doesn't have notifications allowed. The website is already blocked so you shouldn't be able to open it in a browser neither on a PC nor mobile phone with ESET installed.

Thanks Marcos. I don't know what the website is. The notifications pop up when i am not using the mobile. In both cases i couldn't establish which webpage they are connected to. That's what i was asking among other things. I get the notification about the threat, ESET tells me to click on button to clear the notification and no other info on it. When i check the reports on threats you only see those two names but no connection to webpages.

Thanks,

 

Rick

[Marcos 4,587]

You should check notification permissions in your browser setup and remove the above site from the list if it has push notifications allowed.

[peteyt 356]

On 2/18/2023 at 8:14 AM, PassingBy said:

Thanks Marcos. I don't know what the website is. The notifications pop up when i am not using the mobile. In both cases i couldn't establish which webpage they are connected to. That's what i was asking among other things. I get the notification about the threat, ESET tells me to click on button to clear the notification and no other info on it. When i check the reports on threats you only see those two names but no connection to webpages.

Thanks,

 

Rick

Could be an app that's running in the background trying to access the site?

[PassingBy 5]

18 hours ago, peteyt said:

Could be an app that's running in the background trying to access the site?

I wouldn't know what to say. The below is what i see now. The three atop were previously identified as "norman-mobi" and "reza.mobi. Previous occurrences were in January as you can see. Some are false positives. But norman.mobi and reza.mobi kicked in without me using the browser at all, they didn't look normal at all. ESET's notifications are ambiguous, too. They tell you something like "Click here to remove the notification" but they won't tell you if the threat has been blocked. You remove the notification and you don't know which webpage it was on a Firefox Mobile that has like 90 tabs sitting there...So you A) do not what what kicked it; B) Do not know which tab was exactly as you were not using mobile and browser at all. It just popped up. C) The UI does not clarify whether the threat is blocked or not. It just tells you to click and close the notification. The block only shows in the report as  below. Also, a packed inspection in these last days didn't show anything abnormal on the mobile. If you close all apps and run a packed scan what you see is the usual stuff that never goes away. Google services, socials, email push, etc. etc.

Edited February 20 by PassingBy

[Marcos 4,587]

Notifications do not open a link in a browser upon receipt. If you have Notification protection enabled, malicious links in a notification are detected and the notification is not displayed to the user. To prevent receiving such notifications, you must disable them for the particular malicious website in your browser since you must have enabled them in the past. Push notifications from websites get enabled only after user's approval.