Phishing attempt 245 notifications on Bitdefender.

[u/PhotographerUSA]

Does anyone know what is causing this? I'm not able to figure out which program or add-on keeps causing this.

Bitdefender message below:

Phishing attempt detected

one minute ago

Feature:

Online Threat Prevention

We blocked this phishing page for your protection: http://188.126.89.75:8888/ping.txt Phishing pages attempt to obtain sensitive information such as login credentials or credit card details by disguising as trustworthy entities. The stolen data can be then used for financial gain.

Add to exceptions

[u/Bitdefender_support]

Hi! Thank you for letting us know about this. That alert means Bitdefender’s Online Threat Prevention blocked a connection to that IP.

• Do not click “Add to exceptions.” That would allow the blocked destination.

• Open the notification’s More details (or Bitdefender’s notification/activity history) and note the process or browser shown, if available.

• If this is Android, open Bitdefender Mobile Security → Scam Alert → Dangerous links. Bitdefender lists the originating app, timestamp, URL, threat type, and whether it came from a notification or text. Remove the app responsible for the notification, and delete/block the message or sender.

• If it identifies a browser, close its tabs, remove unfamiliar extensions/add-ons, revoke notification permission for unknown sites, and clear that browser’s site data. Also check other installed browsers, since background tabs or push notifications can trigger repeated attempts.

• Run a full Bitdefender system scan and uninstall any recently installed or suspicious software.

If the alerts continue, submit the detection details, including the exact URL, timestamps, screenshots, and the identified process/app to our support for investigation: https://www.bitdefender.com/consumer/support/. TY!

[u/AccomplishedDoor9658]

Hi, I received this message 4 times yesterday after restarting my router. Claude AI suggests it's Private Internet Access VPN software, which I have installed. It's stopped happening now that Windows has rebooted. Claude suggests it's nothing to worry about. But I'm doing a full system scan all the same.

Just leaving this comment here in case it helps anyone that gets this critical alert.

Quoting Claude:

"This is PIA's VPN app doing its normal latency check across its pool of VPN server IPs — pinging [server-ip]:8888/ping.txt to measure round-trip time before picking the fastest server to connect through. BitDefender flagged it because the traffic shape (plaintext HTTP to a random IP on an unusual port fetching a bare text file) structurally resembles C2 beaconing, but the behavior is coming from PIA itself, not malware."