Avoid downloading dubious applications from safebrowsing.network

What is safebrowsing[.]network?

Safebrowsing[.]network is a deceptive/scam site, designed to push users into downloading/installing untrustworthy software. Typically, websites of this type warn visitors of threats/issues detected on their device and offer applications for their elimination. Users should note that no webpage can detect such problems; any that claim to so - cannot be trusted.

The same applies to the content they recommended, it is highly likely to be illegitimate and nonfunctional. In most cases visitors to safebrowsing[.]network and other pages similar to - enter them trough redirects caused by PUAs (Potentially Unwanted Application), already infiltrated into their browsers.

The most common targets of this scam are iPhone users, but it is possible that owners of other Apple products can get redirected to safebrowsing[.]network as well. When accessed, this website displays a pop-up window claiming to have detected four viruses, which can delete contact lists, damage SIM card and device.

Users are urged to follow the instructions presented in the page. Said page repeats the initial warnings and provides removal steps. Firstly, users are instructed to press the button located at the bottom ("remove viruses"), secondly they are to download "My Security" and finally eliminate the threats.

Additionally, this webpage shows a countdown and states that users must act in this given time (though does not state what is likely to occur, when it runs down). All information listed in safebrowsing[.]network is fake, the "detected" viruses are fake and nonexistent on the device.

Following the "removal steps" provided by this website will lead users to downloading/installing some sort of dubious application or similarly untrustworthy content.

PUAs (which open sites like safebrowsing[.]network) can also run intrusive advertisement campaigns and track data. They deliver pop-ups, banners, coupons, surveys and other undesirable ads. However, they are more than just a nuisance, they are considered to be a threat to device/user safety as well.

When clicked, these advertisements redirect to harmful pages and some can execute scripts, designed to stealthily download/install PUAs.

Unwanted apps with data tracking abilities, monitor users' browsing activity (URLs visited, webpages viewed, search queries typed, etc.) and collect their personal information (IP addresses, geolocations and real-life personal details). This sensitive data can then be shared with third parties (potentially, cyber criminals), intent on misusing it for financial gain.

To summarize, PUAs can lead to various infiltrations and infections, financial losses, serious privacy issues and even identity theft. To ensure device/user safety, it is paramount to remove all suspicious applications without delay.

Threat Summary:

Name	safebrowsing.network pop-up
Threat Type	Phishing, Scam, Mac malware, Mac virus
Fake Claim	The scam claims that the device is infected with viruses.
Detection Names	Full List (VirusTotal)
Serving IP Address	104.31.92.113
Symptoms	Your Mac becomes slower than normal, you see unwanted pop-up ads, you are redirected to dubious websites.
Distribution methods	Deceptive pop-up ads, free software installers (bundling), fake Flash Player installers, torrent file downloads.
Damage	Internet browser tracking (potential privacy issues), display of unwanted ads, redirects to dubious websites, loss of private information.
Malware Removal (Mac)	To eliminate possible malware infections, scan your Mac with legitimate antivirus software. Our security researchers recommend using Combo Cleaner. ▼ Download Combo Cleaner for Mac To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.

Manualchecker[.]com, bestantius[.]com, safari-protection[.]com are a few examples of scam websites similar to safebrowsing[.]network. Usually, they employ a variety of scare-tactics to trick users into certain actions. To elaborate, they show warnings of threats/issues found and promote unreliable software for their removal.

It is strongly advised against downloading/installing and/or purchasing content offered by such sites.

How did potentially unwanted applications install on my computer?

The most common mode of PUA proliferation is via download/installation setups of other products. This deceptive marketing method of pre-packing regular software with unwanted or malicious content is called "bundling".

Rushed download/installation processes (e.g. ignored terms, used pre-set options, etc.) - increase the risk of unintentionally allowing bundled apps onto the device. When clicked, intrusive ads can execute scripts to download/install PUAs without user consent.

How to avoid installation of potentially unwanted applications?

Users are encouraged to research content to verify its legitimacy, before downloading/installing it. Only official and verified download channels should be used. P2P sharing networks (BitTorrent, eMule, Gnutella, etc.), free file-hosting websites, third party downloaders and similar sources are considered to be untrustworthy; therefore, they are advised against use.

When downloading/installing, users should read terms, explore all available options, use the "Custom/Advanced" settings and opt-out from supplementary apps, tools, functions, etc. Intrusive adverts often look ordinary and harmless, however they redirect to questionable webpages (e.g. gambling, pornography, adult-dating and so on).

Should users encounter ads/redirect of this kind, it is strongly recommended to inspect the device and immediately remove all suspect applications. If your computer is already infected with PUAs, we recommend running a scan with Combo Cleaner Antivirus for macOS to automatically eliminate them.

Text presented in the pop-up window:

Warning: The device has been infected by (4) viruses! Viruses will damage your mobile phone, SIM card and erase all your contacts! Please follow the instructions on the next page to remove the viruses.

Screenshot of safebrowsing[.]network background page:

Text presented in this page:

Your iPhone has been infected by the viruses (4)!

AppleCare
Protection plan
If not resolved immediately, the viruses could block the mobile phone, SIM card and damage and delete all important files.

To remove the virus immediately:

Step 1: Click the button below.

Step 2: Download the "My Security" on next page to completely eliminate the virus ..

Important: Please act in 59 seconds.

remove viruses
I do not want to repair my device.

Support
Get Support
Service & Repair
Resources
Connect
United States
Copyright © 2019 Apple Inc. All rights reserved.
Privacy Policy
Terms of Use
Sales and Refunds
Site Map

To enable pop-up blocking, fraudulent website warnings, and remove web browsing data in mobile Apple devices, follow these steps:

First, go to "Settings", and then scroll down to find and tap "Safari".

Check if the "Block Pop-ups" and "Fraudulent Website Warning" toggles are enabled. If not, enable them immediately. Then, scroll down and tap "Advanced".

Tap "Website Data" and then "Remove All Website Data".

Instant automatic Mac malware removal: Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of Mac malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner for Mac By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.

Quick menu:

• What is "safebrowsing[.]network"?
• STEP 1. Remove PUA related files and folders from OSX.
• STEP 2. Remove rogue extensions from Safari.
• STEP 3. Remove rogue add-ons from Google Chrome.
• STEP 4. Remove potentially unwanted plug-ins from Mozilla Firefox.

Video showing how to remove adware and browser hijackers from a Mac computer:

Potentially unwanted applications removal:

Remove potentially unwanted applications from your "Applications" folder:

Click the Finder icon. In the Finder window, select "Applications". In the applications folder, look for "MPlayerX","NicePlayer", or other suspicious applications and drag them to the Trash. After removing the potentially unwanted application(s) that cause online ads, scan your Mac for any remaining unwanted components.

Remove adware-related files and folders

Click the Finder icon, from the menu bar. Choose Go, and click Go to Folder...

Check for adware generated files in the /Library/LaunchAgents/ folder:

In the Go to Folder... bar, type: /Library/LaunchAgents/

In the "LaunchAgents" folder, look for any recently-added suspicious files and move them to the Trash. Examples of files generated by adware - "installmac.AppRemoval.plist", "myppes.download.plist", "mykotlerino.ltvbit.plist", "kuklorest.update.plist", etc. Adware commonly installs several files with the exact same string.

Check for adware generated files in the ~/Library/Application Support/ folder:

In the Go to Folder... bar, type: ~/Library/Application Support/

In the "Application Support" folder, look for any recently-added suspicious folders. For example, "MplayerX" or "NicePlayer", and move these folders to the Trash.

Check for adware generated files in the ~/Library/LaunchAgents/ folder:

In the Go to Folder... bar, type: ~/Library/LaunchAgents/

In the "LaunchAgents" folder, look for any recently-added suspicious files and move them to the Trash. Examples of files generated by adware - "installmac.AppRemoval.plist", "myppes.download.plist", "mykotlerino.ltvbit.plist", "kuklorest.update.plist", etc. Adware commonly installs several files with the exact same string.

Check for adware generated files in the /Library/LaunchDaemons/ folder:

In the "Go to Folder..." bar, type: /Library/LaunchDaemons/

In the "LaunchDaemons" folder, look for recently-added suspicious files. For example "com.aoudad.net-preferences.plist", "com.myppes.net-preferences.plist", "com.kuklorest.net-preferences.plist", "com.avickUpd.plist", etc., and move them to the Trash.

Scan your Mac with Combo Cleaner:

If you have followed all the steps correctly, your Mac should be clean of infections. To ensure your system is not infected, run a scan with Combo Cleaner Antivirus. Download it HERE. After downloading the file, double click combocleaner.dmg installer. In the opened window, drag and drop the Combo Cleaner icon on top of the Applications icon. Now open your launchpad and click on the Combo Cleaner icon. Wait until Combo Cleaner updates its virus definition database and click the "Start Combo Scan" button.

Combo Cleaner will scan your Mac for malware infections. If the antivirus scan displays "no threats found" - this means that you can continue with the removal guide; otherwise, it's recommended to remove any found infections before continuing.

After removing files and folders generated by the adware, continue to remove rogue extensions from your Internet browsers.

Remove malicious extensions from Internet browsers

Remove malicious Safari extensions:

Open the Safari browser, from the menu bar, select "Safari" and click "Preferences...".

In the preferences window, select "Extensions" and look for any recently-installed suspicious extensions. When located, click the "Uninstall" button next to it/them. Note that you can safely uninstall all extensions from your Safari browser - none are crucial for regular browser operation.

• If you continue to have problems with browser redirects and unwanted advertisements - Reset Safari.

Remove malicious extensions from Google Chrome:

Click the Chrome menu icon (at the top right corner of Google Chrome), select "More Tools" and click "Extensions". Locate all recently-installed suspicious extensions, select these entries and click "Remove".

• If you continue to have problems with browser redirects and unwanted advertisements - Reset Google Chrome.

Remove malicious extensions from Mozilla Firefox:

Click the Firefox menu (at the top right corner of the main window) and select "Add-ons and themes". Click "Extensions", in the opened window locate all recently-installed suspicious extensions, click on the three dots and then click "Remove".

• If you continue to have problems with browser redirects and unwanted advertisements - Reset Mozilla Firefox.

▼ Show Discussion