109

I am getting strange warning on almost all the websites since morning, including unanalytics.com.

Deceptive site warning

I am pretty much sure that it's a issue in google chrome only. The reason for being sure is, I am getting this on http://localhost too.

I want to know how can we remove this warning. is someone trying to steal the data?

Here are the Extension list I have installed

  • AdBlock
  • Better History
  • Copy All Urls
  • Google Dictionary (by Google)
  • Google Docs Offline
  • Google Translate
  • MakkhiChoose
  • Pushbullet
  • Tab Snooze
  • Tabbie

Google chrome version: Version 66.0.3359.139 (Official Build) (64-bit)

OS: Ubuntu 14.04

11
  • Can you try it in Incognito mode? Do you get the same error? What URL are you trying to access when you see this error? What do you see when you click on the "Details" button on the Warning?
    – Prateek Paranjpe
    May 8 '18 at 11:27
  • 1
    Let me check. Basically the problem occurs when we open some page and keep that page idle for some mins by opening the new page.
    – Manthan Tripathi
    May 8 '18 at 11:29
  • @PrateekParanjpe: Following is what I am getting when I open the Details button Google Safe Browsing recently detected phishing on unanalytics.com. Phishing sites pretend to be other websites to trick you. You can report a detection problem or, if you understand the risks to your security, visit this unsafe site. But I am not opening the unanalytics.com, It happened on stackoverflow.com too.
    – Manthan Tripathi
    May 8 '18 at 11:31
  • 7
    Yeah I've been getting this intermittently. Turned off Better History and hasn't happened again yet.
    – RhodriM
    May 8 '18 at 11:43
  • 1
    More details about the "malice" being spread via that domain - gist.github.com/DrewDennison/bf661461c88cdfe959810811b32676f1
    – Prateek Paranjpe
    May 8 '18 at 11:50
122

I had the extension "Better History" installed also and have just removed it and tried visiting and browsing multiple sites without the warning appearing again.

I will comment again if it does but seems to be a quick fix.

11
  • 12
    Seems this extension causing the issues.
    – Prateek Paranjpe
    May 8 '18 at 11:47
  • 6
    I just deactivated it myself and it seems to fix the issue.
    – Tony Vlcek
    May 8 '18 at 13:06
  • Same here. I think this is the cause.
    – Doug
    May 8 '18 at 18:13
  • 17
    In case you're all interested. There is a fork of better history chrome.google.com/webstore/detail/enhanced-history/…
    – uLan
    May 9 '18 at 4:03
  • 14
    Sound likes Better History died in history for the better. Now history should be better without Better History.
    – wha7ever
    May 9 '18 at 20:19
88

Now I'm reading why Better History is no longer available in the Chrome Web Store:

Better History Chrome extension goes rogue, hijacks browsers and displays ads

A third-party Chrome extension, supposed to make management of your browsing history simpler, has been kicked out of the Chrome web store after users accused it of hijacking their browsing, fiddling with links and opening webpages displaying ads. [...]

4
  • 22
    Yes, indeed it's not there anymore... Would be nice if Chrome warned users "The extension X has been removed from the web store due to Z motives"... I just removed it from my extensions.
    – brasofilo
    May 8 '18 at 22:34
  • @brasofilo i can still find it in the chrome web store
    – Jungkook
    May 9 '18 at 10:43
  • 2
    @SEGod, yesterday I googled the extension and the results were going to a 404 Google page. I tried to search for the extension ID and same results. I searched within the Web Store right now and a similar named extension appears -it's not the same- Chrome Better History. Reviews there are accusing the extension of being rogue too... (edit) The Github repo cited on the article linked in the answer was removed.
    – brasofilo
    May 9 '18 at 19:38
  • 3
    Whats sad is that the original author ended up selling it (presumably because of financial issues), which caused the new changes by the new owner. Either he had this plugin that he cherished and continued to develop, and was forced to sell it for more important needs, or he just wanted to cash in on the plugin, not caring for the users. May 10 '18 at 20:06
3

I added 'Unanalytics.com' to the 'My Filters' list in uBlock Origin to block it. This seems to have resolved the problem for me. This should work in any other ad-blocking plugin too, such as Adblock Plus.

Here is the rule text:

! ...for Google Unsafe Browsing meassage...
||unanalytics.com/* 

UPDATE:

As mentioned in the comments attached below this solution, this is merely a bandage on the problem. The extension still exists and may or may not be malicious.

2
  • This is at best a bandaid for the actual problem, which appears to be a malicious extension. If the extension is behaving badly now, it's likely to continue to do so in the future. By leaving it installed, you'll be open to attack again from whenever it changes to a different domain, until that domain generates enough negative attention to get blocked too. The proper fix is to dump Better History for something not attempting to spy on you. May 9 '18 at 17:16
  • This is all entirely true. After reading through the thread again, and seeing where someone mentioned another fork of the Better History extension, it seems the original has either purposely or inadvertently become a conduit for that Croatian domain. So...better to kill the one I have and install the new fork from the Chrome store. I've updated my solution to echo this comment.
    – spinjector
    May 9 '18 at 17:30

Not the answer you're looking for? Browse other questions tagged or ask your own question.