0

Does anyone knows what is this, where it comes from and how to fix it? It shows up randomly and rare.

enter image description here

URL: data:text/html;base64,PG1ldGEvaHR0cC1lcXVpdj1yZWZyZXNoIGNvbnRlbnQ9MDt1cmw9aHR0cDovL2FkY2xpY2suZy5kb3VibGVjbGljay5uZXQvcGNzL2NsaWNrP2FkdXJsPWh0dHBzJTNBJTJGJTJGc2VydmljZW9wZXJhdGl2ZS5jb20lMkZwYWdlJTJGJTNGZnh0NENYWHI4OUJmVXdjVUdUSjRiNlVERD4=.

  • It would be easier to diagnose this if you posted the error as copiable text. – aaplmath Aug 29 '18 at 22:29
  • URL data:text/html;base64,PG1ldGEvaHR0cC1lcXVpdj1yZWZyZXNoIGNvbnRlbnQ9MDt1cmw9aHR0cDovL2FkY2xpY2suZy5kb3VibGVjbGljay5uZXQvcGNzL2NsaWNrP2FkdXJsPWh0dHBzJTNBJTJGJTJGc2VydmljZW9wZXJhdGl2ZS5jb20lMkZwYWdlJTJGJTNGZnh0NENYWHI4OUJmVXdjVUdUSjRiNlVERD4=. – Ruskes Aug 29 '18 at 22:34
  • 1
    The base-64 decodes to <meta/http-equiv=refresh content=0;url=http://adclick.g.doubleclick.net/pcs/click?adurl=https%3A%2F%2Fserviceoperative.com%2Fpage%2F%3Ffxt4CXXr89BfUwcUGTJ4b6UDD>. Looks like a website/extension is trying to open a page in the background, but instead of directing to a URL, they've mangled their code such that it tries to direct you to a meta tag (an invalid URL) instead. – aaplmath Aug 29 '18 at 22:37
  • @aaplmath in english please, whom do I kill – Ruskes Aug 29 '18 at 23:14
  • 1
    @aaplmath Which decodes to http://adclick.g.doubleclick.net/pcs/click?adurl=https://serviceoperative.com/page/?fxt4CXXr89BfUwcUGTJ4b6UDD – JBis Aug 30 '18 at 2:59
2

Are you navigating the same site when this appears? Is it a sketchy one?

If so, it is most likely a failed scammer ad.

Solution: Don't navigate that page anymore.

If not, then it is most likely an extension. To remove follow these instructions: Install and manage Safari extensions on your Mac or

  1. Go to Safari > Preferences > Extensions
  2. Click extension on left
  3. Click the uninstall button below the Extension name on the right box
  4. Repeat for all extensions

Other information:

As stated in the comments:

data:text/html;base64,PG1ldGEvaHR0cC1lcXVpdj1yZWZyZXNoIGNvbnRlbnQ9MDt1cmw9aHR0cDovL2FkY2xpY2suZy5kb3VibGVjbGljay5uZXQvcGNzL2NsaWNrP2FkdXJsPWh0dHBzJTNBJTJGJTJGc2VydmljZW9wZXJhdGl2ZS5jb20lMkZwYWdlJTJGJTNGZnh0NENYWHI4OUJmVXdjVUdUSjRiNlVERD4=.

is in base64 and decodes to

<meta/http-equiv=refresh content=0;url=http://adclick.g.doubleclick.net/pcs/click?adurl=https%3A%2F%2Fserviceoperative.com%2Fpage%2F%3Ffxt4CXXr89BfUwcUGTJ4b6UDD>

The meta/http-equiv=refresh content=0 tells the browser to redirect the following url in 0 seconds (immediately).

The link further decodes (url decode) to

http://adclick.g.doubleclick.net/pcs/click?adurl=https://serviceoperative.com/page/?fxt4CXXr89BfUwcUGTJ4b6UDD

This is obviously an ad service. https://serviceoperative.com is most likely who is gaining $$ from link views. adclick.g.doubleclick.net is an ad service usually used by sketchy sites.

Both:

http://adclick.g.doubleclick.net/pcs/click?adurl=https://serviceoperative.com/page/?fxt4CXXr89BfUwcUGTJ4b6UDD

and https://serviceoperative.com/page/?fxt4CXXr89BfUwcUGTJ4b6UDD

redirect to google.com


Sidenote:

https://serviceoperative.com has got to have the worst security practices know to earth.

Their homepage requires a login by using CSS to blur the background and prompt for a login:

enter image description here

The CSS specifically is

 -webkit-filter: blur(5px);-webkit-transition-property: -webkit-filter;-webkit-transition-duration: .4s;

By deleting the CSS and the login page from Inspect Element you can bypass the entire login system, which, of course I did.

Here are the peoples homepage that are trying to make money of scamming innocent people.

enter image description here

Seems to be some kind of database of all ads. Gonna give the company and a quick chat.

  • 1
    Wow. I’d have answered the OP browser is going to shite web pages or has a compromised plug in / hostile network operator. I hope you have disinfectant for your browser after visiting those sites. – bmike Aug 30 '18 at 3:52
  • @bmike Lol. Prob not the smartest thing. If anything more serious probably would have done in a VM, but I find crap like this is more annoying than harmful. XD – JBis Aug 30 '18 at 3:55
  • I do not use Safari. It was in Firefox. – Ruskes Aug 30 '18 at 4:43
  • @Buscar웃 will edit tomorrow but same difference remove extensions or bad site – JBis Aug 30 '18 at 5:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .