Jump to content
JustRay

ANSWERED cdn.onesignal.com being blocked

Recommended Posts

Morning.

Malwarebytes Premium 3.7.1

Windows 10 home with all available updates applied

Have been running MWB for years without issues.  Love it.

Yesterday, my Chrome browser was updated to 73.0.3683.103 (64-bit).

This morning I notice, that while I am bowing CNN via the Chrome browser, MWB displays a pop up window indicating a website has been blocked due to PUP.

This seems to occur if I click on any link or news article on CNN.

but, ONLY CNN.

Is anyone else experiencing this ?

May I ask for for some advice on how to deal with this ?

Thanks.

Here's some additional info from MWB:

-Blocked Website Details-
Malicious Website: 1
, , Blocked, [-1], [-1],0.0.0

-Website Data-
Category: PUP
Domain: cdn.onesignal.com
IP Address: 104.16.205.165
Port: [51073]
Type: Outbound
File: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

 

Share this post


Link to post
Share on other sites

I can't reproduce the block on cnn.com here? (the block itself is not an F/P)

Share this post


Link to post
Share on other sites

I am getting the similar popop/block numerous times on many web sites

Difference is IP address is 104.16.207.165 with port 53689

It has popped up about a dozen times this morning and it just started doing this today.

 

 

 

Share this post


Link to post
Share on other sites

I now know, that my issue has nothing to do specifically with Chrome.

As I get the identical behavior when accessing anything on the CNN site, if using the Edge or Internet Explorer browsers.

Mmmmm.

Share this post


Link to post
Share on other sites
Posted (edited)

Hi @JustRay,

Does the block occur with all CNN.com pages or just certain pages?
Can you provide the URL of a CNN page that you experience the block on please?

To help us better understand why you're experiencing this block on the CNN.com website, capturing a trace with a program called Fiddler will help.
Here are steps on how to do so:

  • Close your browser.
  • Download and install Fiddler: https://www.telerik.com/download/fiddler/fiddler2
  • Launch the program once installed.
  • Open Google Chrome and navigate to a CNN webpage that you experience the Malwarebytes website block on.
  • When the Malwarebytes block occurs, return to the Fiddler window and save the trace by clicking File followed by Save followed by All Sessions.
  • Once saved, open the folder containing the .saz file. Right-click the file and click Send to followed by Compressed (Zipped) folder.
  • Please send a Private Message to me (hover over my name and click Message) with the Zip file attached.


Thank you!

Edited by LiquidTension

Share this post


Link to post
Share on other sites

So I came searching because my company's intranet site is behaving the same way. The thing is, OneSignal is a push notification API I have subscribed to to allow my website to send notifications to desktop and mobile users. It is not malicious, and shouldn't be blocked (in my opinion). This behavior just started today but I've been using OneSignal for on this site for over a year. 

My guess is many websites use OneSignal for notifications on their website, and if you've allowed them in your browser then the connection to this site is attempted. For some reason, MalwareBytes has decided to block them. 

Share this post


Link to post
Share on other sites

This is driving me nuts.  Its basically every news site I visit in ANY browser.   I see the logic in blocking it as i really am not interested in anything onesignal has to offer.  I would however like to know how to suppress the alerts. I have this domain blocked on my firewall.

Share this post


Link to post
Share on other sites

I am using Fire 66.0.03(64 Bit). Same issue

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 4/10/19
Protection Event Time: 1:17 PM
Log File: b323ff10-5bcd-11e9-a8be-3860775e262e.json

-Software Information-
Version: 3.7.1.2839
Components Version: 1.0.563
Update Package Version: 1.0.10088
License: Premium

-System Information-
OS: Windows 10 (Build 17763.437)
CPU: x64
File System: NTFS
User: System

-Blocked Website Details-
Malicious Website: 1
, , Blocked, [-1], [-1],0.0.0

-Website Data-
Category: PUP
Domain: cdn.onesignal.com
IP Address: 104.16.208.165
Port: [53196]
Type: Outbound
File: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

 

(end)

Share this post


Link to post
Share on other sites
8 hours ago, JustRay said:

Morning.

Malwarebytes Premium 3.7.1

Windows 10 home with all available updates applied

Have been running MWB for years without issues.  Love it.

Yesterday, my Chrome browser was updated to 73.0.3683.103 (64-bit).

This morning I notice, that while I am bowing CNN via the Chrome browser, MWB displays a pop up window indicating a website has been blocked due to PUP.

This seems to occur if I click on any link or news article on CNN.

but, ONLY CNN.

Is anyone else experiencing this ?

May I ask for for some advice on how to deal with this ?

Thanks.

Here's some additional info from MWB:

-Blocked Website Details-
Malicious Website: 1
, , Blocked, [-1], [-1],0.0.0

-Website Data-
Category: PUP
Domain: cdn.onesignal.com
IP Address: 104.16.205.165
Port: [51073]
Type: Outbound
File: C:\Program Files (x86)\Google\Chrome\Application\chrome.exeI

Having the same problem, in the same immediate time frame, but not with CNN.

I get the "blocked PUP" warning on any click involving www.forexlive.com

C'mon Malwarebytes ... seems clear you have an issue here.

Share this post


Link to post
Share on other sites

Same here- It's OneSignal that's getting blocked on pretty much any page (CNN in particular).

 

I do not permit any notifications and have them all blocked, so malwarebytes is doing the correct behaviour. I don't want anything pushed. I deny it. 

 

So thank you- all I want to do is stop seeing the notification for it :)

Same here- It's OneSignal that's getting blocked on pretty much any page (CNN in particular).

 

I do not permit any notifications and have them all blocked, so malwarebytes is doing the correct behaviour. I don't want anything pushed. I deny it. 

 

So thank you- all I want to do is stop seeing the notification for it :)

Share this post


Link to post
Share on other sites

Got the same problem as you all. Except it is a news channel "wowt.com". This started just today. And I am using the Firefox Browser. When I go into the same site using MS Edge, I don't have a problem with it at all. Maybe it is a certain browser's issue. This is what I got from the report tab. And I am using the "Malwarebytes Premium version  3.7.1".

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 4/10/19
Protection Event Time: 7:17 PM
Log File: 325c0a54-5bef-11e9-bec3-50465d59736e.json

-Software Information-
Version: 3.7.1.2839
Components Version: 1.0.563
Update Package Version: 1.0.10092
License: Premium

-System Information-
OS: Windows 10 (Build 18362.53)
CPU: x64
File System: NTFS
User: System

-Blocked Website Details-
Malicious Website: 1
, , Blocked, [-1], [-1],0.0.0

-Website Data-
Category: PUP
Domain: cdn.onesignal.com
IP Address: 104.16.206.165
Port: [52328]
Type: Outbound
File: C:\Program Files\Mozilla Firefox\firefox.exe

 

(end)

Share this post


Link to post
Share on other sites

Update has been sent out. Please run an update and this should no longer be blocked. 

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.