Help me with weird Chrome phishing issue?
October 18, 2021 7:11 AM Subscribe
In the last few days, my version of Chrome has been behaving oddly. I keep getting the Chrome warning that tells me not to go to a site called albumsiwishexisted.blogspot.com because there it is insecure. However, I am always trying to go to a different site, like Gmail. This blogspot site is vaguely familiar (in fact, I think I may have visited it from Metafilter?) but I haven't gone there recently.
Here is a screenshot. Initially, this happened specifically when I tried to visit Gmail and then somehow the problem went away and I could go to gmail directly.
I don't recall clicking on anything weird in my email. I have deleted my cache and cookies for the last two weeks. I do not have very many Chrome extensions and didn't notice anything new. Also, I downloaded Malware Bytes and it didn't detect anything.
One theory I have is that perhaps it's somehow connected to my bookmarks: maybe a virus added a redirect to them, and perhaps visiting Gmail directly reset the bookmark to its proper url. Another possibility is that I got a new computer at work and synched Chrome to my home laptop, so perhaps something happened there.
Here is a screenshot. Initially, this happened specifically when I tried to visit Gmail and then somehow the problem went away and I could go to gmail directly.
I don't recall clicking on anything weird in my email. I have deleted my cache and cookies for the last two weeks. I do not have very many Chrome extensions and didn't notice anything new. Also, I downloaded Malware Bytes and it didn't detect anything.
One theory I have is that perhaps it's somehow connected to my bookmarks: maybe a virus added a redirect to them, and perhaps visiting Gmail directly reset the bookmark to its proper url. Another possibility is that I got a new computer at work and synched Chrome to my home laptop, so perhaps something happened there.
Best answer: I don't have a direct answer, but here are some thoughts:
1. Does this only happen when you're using a bookmark? Or does it also happen when you type in the URL of gmail or other sites directly? This would help narrow down if it's a bookmark issue.
2. I can access https://albumsiwishexisted.blogspot.com without seeing a warning. Does clicking my link still give you the warning?
If not, I'd be concerned that something is taking you to a site that looks like albumsiwishexisted.blogspot.com but uses lookalike characters in the URL.
If the warning does appear, it might be a false alarm, but it's still odd that you would get it and I wouldn't.
posted by enigmango at 8:50 AM on October 18, 2021 [1 favorite]
1. Does this only happen when you're using a bookmark? Or does it also happen when you type in the URL of gmail or other sites directly? This would help narrow down if it's a bookmark issue.
2. I can access https://albumsiwishexisted.blogspot.com without seeing a warning. Does clicking my link still give you the warning?
If not, I'd be concerned that something is taking you to a site that looks like albumsiwishexisted.blogspot.com but uses lookalike characters in the URL.
If the warning does appear, it might be a false alarm, but it's still odd that you would get it and I wouldn't.
posted by enigmango at 8:50 AM on October 18, 2021 [1 favorite]
Response by poster: Dear adamrice and enigmango, thank you so much for this kind and thoughtful replies!
So I wish I had been more methodical when I first noticed this problem. My initial guess was that the bookmark for "gmail" had actually been this weird blogspot site, but somehow when I hand-typed "gmail" in, it overrode it. Not sure how possible that is. I did check other bookmarks and not all of them led me to that site. Perhaps it is a mistake in the Chrome phishing detector.
1) When I inspect my bookmarks in the Bookmarks Manager, they seem to be normal. I'll check the next time this happens on the bookmark.
2) Right now, it does not happen when I hand-type gmail or use my gmail bookmarks. I am not sure if this has happened with any hand-typed link, but I could be wrong. This does not happen in Firefox.
3) When I click the link to albumsiwish.existed, I do not actually get the warning--just a note that the blog is not found.
Maybe the next time I get this warning, I can copy the actual text of that url and somehow parse if there are lookalike characters?
By this point, I've managed to work my way around it, but it just seems very odd--partly since that site doesn't exist and also since it doesn't seem like there's a way that a malicious hacker could use it against me...
posted by johnasdf at 9:30 AM on October 18, 2021
So I wish I had been more methodical when I first noticed this problem. My initial guess was that the bookmark for "gmail" had actually been this weird blogspot site, but somehow when I hand-typed "gmail" in, it overrode it. Not sure how possible that is. I did check other bookmarks and not all of them led me to that site. Perhaps it is a mistake in the Chrome phishing detector.
1) When I inspect my bookmarks in the Bookmarks Manager, they seem to be normal. I'll check the next time this happens on the bookmark.
2) Right now, it does not happen when I hand-type gmail or use my gmail bookmarks. I am not sure if this has happened with any hand-typed link, but I could be wrong. This does not happen in Firefox.
3) When I click the link to albumsiwish.existed, I do not actually get the warning--just a note that the blog is not found.
Maybe the next time I get this warning, I can copy the actual text of that url and somehow parse if there are lookalike characters?
By this point, I've managed to work my way around it, but it just seems very odd--partly since that site doesn't exist and also since it doesn't seem like there's a way that a malicious hacker could use it against me...
posted by johnasdf at 9:30 AM on October 18, 2021
« Older Talking with teenagers about existential angst | We Didn't Start the Fire(side Chat) Newer »
This thread is closed to new comments.
Does this happen if you hand-type "gmail.com" into the address bar in Chrome? Does it happen in any other browser? If so, something more pernicious is going on, and someone has possibly rewritten your Hosts file, or something else. But this would be weird, since no one benefits from redirecting you to that defunct blogspot blog.
posted by adamrice at 8:46 AM on October 18, 2021 [1 favorite]