Why is h[.]parrable[.]com blocked?

[asda]

Over the past few days we've been receiving tons of alerts from Malwarebytes for traffic to h[.]parrable[.]com. After a bit of analysis I found the file dropped from that site is gmpopenh264[.]dll[.]tmp but it is signed by Mozilla and deemed safe by VirusTotal. The file hash is:ced08ce5bc45dbe505fa94b3a4268c0830ccda016a23c0acb16dd7268cfa7a65

So it appears the site itself is just classified as malicious, does anyone know why or have they experienced this too recently?

[JPopovic]

The domain itself is infected.

Also, here are some detected files:

http://parrable.com/wp-includes/js/jquery/jquery.min.js
https://parrable.com/wp-content/themes/oceanwp/assets/js/scroll-effect.min.js 

Thank you.

[asda]

35 minutes ago, JPopovic said:

The domain itself is infected.

Also, here are some detected files:

http://parrable.com/wp-includes/js/jquery/jquery.min.js
https://parrable.com/wp-content/themes/oceanwp/assets/js/scroll-effect.min.js 

Thank you.

Do you know where I can find more details on this infection?

[JPopovic]

You can find it on VirusTotal.

[keep_going]

I never went to that domain and have gotten that notification repeatedly since Saturday.  Closing chrome stops the error from repeating but I have no idea what's causing it.

[Porthos]

32 minutes ago, keep_going said:

Closing chrome stops the error from repeating but I have no idea what's causing it.

It is probably an extension in Chrome calling out to that site for whatever reason.

[keep_going]

6 minutes ago, Porthos said:

It is probably an extension in Chrome calling out to that site for whatever reason.

Any idea how to isolate that extension or troubleshoot otherwise to ensure that?  It appears to only happen when I have multiple tabs open in Incognito mode and closing that window stops the error from reappearing.  I didn't even think extensions worked in Incognito mode.

[Porthos]

4 minutes ago, keep_going said:

I didn't even think extensions worked in Incognito mode.

Some do. You would have to disable all of them and reenable them one at a time.

[keep_going]

Thanks.  Why might an extension call out to it?  The site itself is listed as having a trojan...

[cyk]

I get the alert from Malwarebytes every time I visit a certain websites. When I disabled all the extension I had on Chrome, I still get the alert. What does it mean?

[Porthos]

12 minutes ago, keep_going said:

Why might an extension call out to it?

Extensions do communicate. That is how they update and other things as well. Some go rouge as well sometimes.

Please follow the instructions in this topic then create a new topic in our malware removal area by clicking here and a malware removal specialist will guide you in checking and cleaning your system of any threats. 

[Porthos]

1 minute ago, cyk said:

I get the alert from Malwarebytes every time I visit a certain websites. When I disabled all the extension I had on Chrome, I still get the alert. What does it mean?

Please follow the instructions in this topic then create a new topic in our malware removal area by clicking here and a malware removal specialist will guide you in checking and cleaning your system of any threats. 

[cyk]

1 hour ago, Porthos said:

Please follow the instructions in this topic then create a new topic in our malware removal area by clicking here and a malware removal specialist will guide you in checking and cleaning your system of any threats. 

Thank you.

[AdvancedSetup]

If using another browser besides Google Chrome makes the block go away then you might try the following clean up for Google Chrome

 

Please follow the directions from the following topic and let us know if that corrects the issue for you.

 

Thank you

 

[AdvancedSetup]

Since the site parrable.com has been taken down the threat is no longer present. We will remove the block

https://decoded.avast.io/janrubin/parrot-tds-takes-over-web-servers-and-threatens-millions/

 

[oldschoolblue]

On 9/21/2022 at 4:05 AM, AdvancedSetup said:

Since the site parrable.com has been taken down the threat is no longer present. We will remove the block

https://decoded.avast.io/janrubin/parrot-tds-takes-over-web-servers-and-threatens-millions/

 

FYI:  Site linked (avast.io) gives a certificate warning in Firefox.

Still seeing a few of these h[dot]parrable[dhot]com blocks from a range of Nebula clients.  Chrome and Edge, no indication of Firefox yet but we have few users on FF.

[AdvancedSetup]

Thanks. We removed the block for now as the site was down, but due to an FP yesterday that we're reviewing, that update removal was not pushed out yet.

Use of a Content Blocker should help, or if too many alerts you can add an exclusion for now.

 

 

[keep_going]

Thanks for blocking these Malwarebytes!