1

I've been seeing a very weird request being made from my Chrome browser (haven't noticed it on Brave). It does not run on all websites, and not all the time (it can appear on a website, then after a reload it disappears from devtools).

NOT SURE WHAT HAPPENS IF YOU OPEN THE LINK

Here's a couple of examples

http://subpyramidical.she-nding.com/?a=YTIyMTExeNJNhwsW2l5F2lkW310WihhflRxIy0lDkBQWwxQRkBEVkERQ0h0fxR4c0kJa01lNwUtEwQkJzQtCgxFVgEoAnEoEyVx2rUsCzlx2-kt1-Vwpv10yqE8goU9i7ENgpFQUxAZdyAJfzwVZzABfyQJYzQ

https://subpyramidical.she-nding.com/?a=MGQ2MTY5eH1NKEZzGyYFQ2wlARwiD0gPcxZaZUgpbxF2fVsbTmAta15uSRlWXmFrQTBFcHN-Rwlvf2o_HWtseCJ4HA4fGRNVBSMDUWoATg9vX1EyFDg8ATZ8Fg1RNihrNhN9czJkelYTD1QYXTNJewcgRRltPgYeMhdSU21HQH8SeX0Hby8FE1N8LDtXeQJBVQFpOAV8QHw9OgcUaT0_TmIPVldQJX5JJUouNXYLF2c

A whois on the domain reveals it's registered by http://privacyprotect.org which, from what I gather is a service meant to obfuscate real domain owners whois info. When I cURL the URL, it's a 1x1 image. There is a query parameter in the URL which I don't know what it contains (it doesn't look like a JWT and I haven't been able to identify the hash). There is no initiator for the request in dev tools.

If I run chrome with the disabled plugins/extensions, the request FAILS to be blocked (I haven't been able to "catch" it without request blockers (ublock etc)).Which might mean it's hidden because it's not being blocked. Anyway, very weird, I'm kind of lost as to where to continue or any idea what it might be or how I would remedy it, as it is obviously some sort of malware that hаs affected the machine. Also I'm running Ubuntu 18 LTS, latest updates etc. Ran linux anti-malware software (the few most popular options I found by googling), they came up empty. devtools screenshot

Open to any ideas as to what it might be, or how I might proceed either with identifying the cause or how I would "fix" it (without wiping the machine of course)?

  • 2
    From the description (1x1 pixel) this looks like normal tracking for me. What makes you think that this is something different? Also, it is not clear from your question where it is embedded. It is also not clear if it happens at all if you have all extensions disabled, it is not clear what extension you have usually enabled (might be caused by an extension) etc. In other words: too much unknowns to me. – Steffen Ullrich Oct 10 at 13:45
  • The extensions I normally have active (in the screenshot) are as follows: uBlock Origin, Vimium, HTTP Everywhere, lightshot, Privacy badger, JSONview, minerBlock, Privacy Pass, Video speed controller, sidewise, some canvas-fingerprinting one, PixelBlock, session buddy, IG stories for Instagram, Bitwarden, Full page screenshot :) As you can see, a lot of them are request/tracker blockers. The request doesn't appear EVERY time, but I noticed I cannot see the request AT ALL with --disable-plugins flag on chrome. – capG Oct 10 at 14:16
  • I agree with there being too much unknowns, that's why I'm posting the question because I've hit a wall. It's not normal tracking, when visiting the same website, sometimes it appears, sometimes not. Also hiding behind a bitcoin registar doesn't really scream "trustworthy" or "legitimate" – capG Oct 10 at 14:17
  • 1
    I suggest you disable any extensions which are not explicitly used to block such traffic. Then check if these URL still occur. If not they might be caused by any of the other plugins which you can find out by selectively enabling these plugins again. – Steffen Ullrich Oct 10 at 14:23
  • What makes you think that this is something different? -This is a bitcoin registered domain, with the intent to hide the owners info. Also, it is not clear from your question where it is embedded. -Screenshot -> Initiator says "Other". That's as much as I know It is also not clear if it happens at all if you have all extensions disabled -Yes, it's not, I haven't been able to reproduce it, the come-and-go nature of it adds suspicion EVEN more. it is not clear what extension you have usually enabled (might be caused by an extension) -Extensions seem to help with "catching it" – capG Oct 10 at 14:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.