0

My elderly parents are receiving chrome notifications from a strange URL on their iMac: (https://s1.snc.com.ru:443)

Example Messages

• Pending Payment: Paypal Has Sent You $65,900

• Clean your mac. Do not ignore this message.

Screenshot of Notifications

I've remotely connected and scanned with Malwarebytes & Avast, but have found no threats.

I didn't see any issues when checking the URL on VirusTotal either. Visiting the URL renders a progress bar made with Bootstrap/Javascript and asks for permission to give notifications. Of course, I click no/block. There's some interesting javascript in the sourcecode that has a couple other URLS.

I've just blocked the notifications for now, but I'm really curious; what is this? Did I screw up by visiting the URL?

  • You may want to check the installed extensions/add-ons in the browser. Also maybe check that they don't have an alternate DNS setting in the browser. – Daisetsu Mar 7 '19 at 6:07
1

The site asks permission to send Web Push Notifications. That's not technically a malware and won't get detected as such. The site is just using this permission in a malicious way by sending these spam messages. That's pretty common.

You must teach your parents some basic rules on the Internet: Don't click yes on everything. By default, select no if you don't understand the question. You could also tweak their browser to help them with this task:

  • Disabled web push notifications altogether by selecting Do not allow any site to show notifications from the Content Settings.
  • You could also disable location by selecting Do not allow any site to track your physical location.
  • Revise all Content Settings and disable everything your parents won't actually need.
| improve this answer | |
  • Thank you so much for your input and the articles. Very helpful! – Jaguilar Mar 7 '19 at 15:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.