what is dataprovider.biz ?

[BillH99999]

I have a couple shortcuts on my desktop for various Malwarebytes forums including this one.  If I click on the shortcut to open Chrome to one of these forums, I immediately get a warning that dataprovider.biz is being blocked by the extension.  This just started happening recently and it happens for all of my shortcuts to Malwarebytes forum.  It doesn't happen for other shortcuts I have to other sites.  

What is dataprovider.biz and why is it getting blocked only on Malwarebytes forums?

[rakka]

When I visit the site, I get 404 error so not sure what exactly it is. 

the block is due to .biz domain name, we block those by default since they are known to spread malware.

Edited April 15, 2019 by rakeshsejwal

[BillH99999]

@rakeshsejwal

I guess my real question is why am I getting this only when I use my desktop shortcuts to go to Malwarebytes forums.  I don't get this for any other sites.  It only happens if Chrome is not open already and clicking the desktop shortcut opens Chrome and takes me to the site.  Why is Malwarebytes directing me to this site?

Bll

[rakka]

how are you creating the shortcut? looks like something in the middle doing re-direction. 

[BillH99999]

@rakka

Thanks for the reply.  I am creating the shortcut by dragging the lock icon in the address bar to the desktop.   I don't see how anything could be "in the middle".

Today it happened with a link in an email to the Toyota website.

I'm beginning to wonder if my computer is infected somehow.  I ran ADWcleaner and nothing is found with either program.  My daily Malwarebytes threat scan didn't find anything.  Also did a scan with Norton Security and it didn't find anything.  

I did a search and couldn't find anything in regards to dataprovider.biz being malware or any malware directing people to dataprovider.biz.

Any ideas on how I might be able to figure out what is going on?

Thanks
Bill

[BillH99999]

@rakka

Your thought that something in the middle might be re-directing things made me think.  I disabled all my Chrome extensions and then re-enabled them one by one.  I found what I think is the culprit.  It is called "Disable HTML5 Autoplay (Reloaded)".  I removed this extension from Chrome.  I then re-enabled the Malwarebytes extension and so far no attempts to go to dataprovider.biz have been blocked.  I'll keep an eye on it for awhile to ensure that was the guilty extension.

Thanks for the hint!

Bill

[exile360]

Based on the name of the domain it sounds like some kind of telemetry/tracking server, so I'm guessing this plugin submits data to that provider for a kickback of some kind, so basically it's a PUP.  If you happen to have a link to the extension like from the Chrome web store, I'd suggest submitting it to Research for analysis.

[BillH99999]

@exile360

OK... done.

Thanks,
Bill