JustRay Posted April 10, 2019 ID:1307350 Share Posted April 10, 2019 Morning. Malwarebytes Premium 3.7.1 Windows 10 home with all available updates applied Have been running MWB for years without issues. Love it. Yesterday, my Chrome browser was updated to 73.0.3683.103 (64-bit). This morning I notice, that while I am bowing CNN via the Chrome browser, MWB displays a pop up window indicating a website has been blocked due to PUP. This seems to occur if I click on any link or news article on CNN. but, ONLY CNN. Is anyone else experiencing this ? May I ask for for some advice on how to deal with this ? Thanks. Here's some additional info from MWB: -Blocked Website Details- Malicious Website: 1 , , Blocked, [-1], [-1],0.0.0 -Website Data- Category: PUP Domain: cdn.onesignal.com IP Address: 104.16.205.165 Port: [51073] Type: Outbound File: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Link to post Share on other sites More sharing options...
MysteryFCM Posted April 10, 2019 ID:1307358 Share Posted April 10, 2019 I can't reproduce the block on cnn.com here? (the block itself is not an F/P) Link to post Share on other sites More sharing options...
JustRay Posted April 10, 2019 Author ID:1307361 Share Posted April 10, 2019 Thanks for the quick reply Steven. Good to know. Link to post Share on other sites More sharing options...
Mytmoss Posted April 10, 2019 ID:1307364 Share Posted April 10, 2019 I am getting the similar popop/block numerous times on many web sites Difference is IP address is 104.16.207.165 with port 53689 It has popped up about a dozen times this morning and it just started doing this today. Link to post Share on other sites More sharing options...
JustRay Posted April 10, 2019 Author ID:1307365 Share Posted April 10, 2019 I now know, that my issue has nothing to do specifically with Chrome. As I get the identical behavior when accessing anything on the CNN site, if using the Edge or Internet Explorer browsers. Mmmmm. Link to post Share on other sites More sharing options...
Mytmoss Posted April 10, 2019 ID:1307366 Share Posted April 10, 2019 I forgot to mention I am using Firefox Link to post Share on other sites More sharing options...
LiquidTension Posted April 10, 2019 ID:1307374 Share Posted April 10, 2019 (edited) Hi @JustRay, Does the block occur with all CNN.com pages or just certain pages? Can you provide the URL of a CNN page that you experience the block on please? To help us better understand why you're experiencing this block on the CNN.com website, capturing a trace with a program called Fiddler will help. Here are steps on how to do so: Close your browser. Download and install Fiddler: https://www.telerik.com/download/fiddler/fiddler2 Launch the program once installed. Open Google Chrome and navigate to a CNN webpage that you experience the Malwarebytes website block on. When the Malwarebytes block occurs, return to the Fiddler window and save the trace by clicking File followed by Save followed by All Sessions. Once saved, open the folder containing the .saz file. Right-click the file and click Send to followed by Compressed (Zipped) folder. Please send a Private Message to me (hover over my name and click Message) with the Zip file attached. Thank you! Edited April 10, 2019 by LiquidTension Link to post Share on other sites More sharing options...
Mytmoss Posted April 10, 2019 ID:1307375 Share Posted April 10, 2019 I am getting the pop up when I go to https://www.viewbug.com/member/mytmoss And I am using Firefox Link to post Share on other sites More sharing options...
mattds91 Posted April 10, 2019 ID:1307379 Share Posted April 10, 2019 So I came searching because my company's intranet site is behaving the same way. The thing is, OneSignal is a push notification API I have subscribed to to allow my website to send notifications to desktop and mobile users. It is not malicious, and shouldn't be blocked (in my opinion). This behavior just started today but I've been using OneSignal for on this site for over a year. My guess is many websites use OneSignal for notifications on their website, and if you've allowed them in your browser then the connection to this site is attempted. For some reason, MalwareBytes has decided to block them. Link to post Share on other sites More sharing options...
gdonesignal Posted April 10, 2019 ID:1307394 Share Posted April 10, 2019 Hi Malwarebytes team. I help work on OneSignal. I have sent a private message to you @LiquidTension and @MysteryFCM to do what I can to help look into this. Link to post Share on other sites More sharing options...
sherrb1158 Posted April 10, 2019 ID:1307395 Share Posted April 10, 2019 I'm getting the same message from MWB on multiple page on dailycaller.com using Firefox. Link to post Share on other sites More sharing options...
kd4pba Posted April 10, 2019 ID:1307406 Share Posted April 10, 2019 This is driving me nuts. Its basically every news site I visit in ANY browser. I see the logic in blocking it as i really am not interested in anything onesignal has to offer. I would however like to know how to suppress the alerts. I have this domain blocked on my firewall. Link to post Share on other sites More sharing options...
ITISMike Posted April 10, 2019 ID:1307425 Share Posted April 10, 2019 I am using Fire 66.0.03(64 Bit). Same issue Malwarebytes www.malwarebytes.com -Log Details- Protection Event Date: 4/10/19 Protection Event Time: 1:17 PM Log File: b323ff10-5bcd-11e9-a8be-3860775e262e.json -Software Information- Version: 3.7.1.2839 Components Version: 1.0.563 Update Package Version: 1.0.10088 License: Premium -System Information- OS: Windows 10 (Build 17763.437) CPU: x64 File System: NTFS User: System -Blocked Website Details- Malicious Website: 1 , , Blocked, [-1], [-1],0.0.0 -Website Data- Category: PUP Domain: cdn.onesignal.com IP Address: 104.16.208.165 Port: [53196] Type: Outbound File: C:\Program Files (x86)\Mozilla Firefox\firefox.exe (end) Link to post Share on other sites More sharing options...
YukiTaga Posted April 10, 2019 ID:1307428 Share Posted April 10, 2019 8 hours ago, JustRay said: Morning. Malwarebytes Premium 3.7.1 Windows 10 home with all available updates applied Have been running MWB for years without issues. Love it. Yesterday, my Chrome browser was updated to 73.0.3683.103 (64-bit). This morning I notice, that while I am bowing CNN via the Chrome browser, MWB displays a pop up window indicating a website has been blocked due to PUP. This seems to occur if I click on any link or news article on CNN. but, ONLY CNN. Is anyone else experiencing this ? May I ask for for some advice on how to deal with this ? Thanks. Here's some additional info from MWB: -Blocked Website Details- Malicious Website: 1 , , Blocked, [-1], [-1],0.0.0 -Website Data- Category: PUP Domain: cdn.onesignal.com IP Address: 104.16.205.165 Port: [51073] Type: Outbound File: C:\Program Files (x86)\Google\Chrome\Application\chrome.exeI Having the same problem, in the same immediate time frame, but not with CNN. I get the "blocked PUP" warning on any click involving www.forexlive.com C'mon Malwarebytes ... seems clear you have an issue here. Link to post Share on other sites More sharing options...
purduephotog Posted April 10, 2019 ID:1307431 Share Posted April 10, 2019 Same here- It's OneSignal that's getting blocked on pretty much any page (CNN in particular). I do not permit any notifications and have them all blocked, so malwarebytes is doing the correct behaviour. I don't want anything pushed. I deny it. So thank you- all I want to do is stop seeing the notification for it Same here- It's OneSignal that's getting blocked on pretty much any page (CNN in particular). I do not permit any notifications and have them all blocked, so malwarebytes is doing the correct behaviour. I don't want anything pushed. I deny it. So thank you- all I want to do is stop seeing the notification for it Link to post Share on other sites More sharing options...
Alienmenace54 Posted April 11, 2019 ID:1307449 Share Posted April 11, 2019 Got the same problem as you all. Except it is a news channel "wowt.com". This started just today. And I am using the Firefox Browser. When I go into the same site using MS Edge, I don't have a problem with it at all. Maybe it is a certain browser's issue. This is what I got from the report tab. And I am using the "Malwarebytes Premium version 3.7.1". Malwarebytes www.malwarebytes.com -Log Details- Protection Event Date: 4/10/19 Protection Event Time: 7:17 PM Log File: 325c0a54-5bef-11e9-bec3-50465d59736e.json -Software Information- Version: 3.7.1.2839 Components Version: 1.0.563 Update Package Version: 1.0.10092 License: Premium -System Information- OS: Windows 10 (Build 18362.53) CPU: x64 File System: NTFS User: System -Blocked Website Details- Malicious Website: 1 , , Blocked, [-1], [-1],0.0.0 -Website Data- Category: PUP Domain: cdn.onesignal.com IP Address: 104.16.206.165 Port: [52328] Type: Outbound File: C:\Program Files\Mozilla Firefox\firefox.exe (end) Link to post Share on other sites More sharing options...
Staff Zynthesist Posted April 11, 2019 Staff ID:1307450 Share Posted April 11, 2019 I am removing this block now and will push out a new update shortly. Link to post Share on other sites More sharing options...
Alienmenace54 Posted April 11, 2019 ID:1307453 Share Posted April 11, 2019 Thank you Link to post Share on other sites More sharing options...
Staff Solution Zynthesist Posted April 11, 2019 Staff Solution ID:1307460 Share Posted April 11, 2019 Update has been sent out. Please run an update and this should no longer be blocked. Link to post Share on other sites More sharing options...
Recommended Posts