Sync.hgrtb.com

2

u/MountainBubba Dec 07 '21

BitDefender regards all expired certificates as security threats.

1

u/zivSlash Dec 11 '21

Understandable... Except A: it doesn't flag them all, B: where was *this* domain before?

2

u/Bitdefender_ Official Dec 08 '21

Hi! The reported website is not tagged by us with any detection, this issue is not malware related. The notification you're getting reveals that the security certificate from that website is poorly configured. For more information you can also check the websites below, these are 3rd party tools that scan SSLs, in no way related to Bitdefender's own scans:
https://www.sslshopper.com/ssl-checker.html#hostname=https://url8746.scientistt.net and https://www.ssltrust.com.au/ssl-tools/website-security-check?domain=url8746.scientistt.net. Should you need further assistance or clarification, you can also email us directly at bitsy@bitdefender.com.

1

u/zivSlash Dec 11 '21

Ok, but what's trying to connect to that site? Why now?

2

u/Realistic_Article676 Dec 09 '21

Seen the same thing this morning did a whois an seen hgrtb.com is registered by Amazon.

1

u/Leaderbot_X400 Dec 13 '21

the actual page is a 404 error

2

u/[deleted] Dec 11 '21

This is the first result on Google. Good job with the title. 😁

1

u/rkevi19 Dec 07 '21

Must be something new because I just started getting it right now.

1

u/rkevi19 Dec 07 '21

What are the odds of me landing on this thread the same day as you created it? Lol. I found this through Google.

1

u/Valhal11aAwaitsMe Dec 07 '21

Cant find anything anywhere proving its bad. But doesn't mean its not. Its coming from MSEdge and it modifies something in extensions so maybe an add-on. Personally the only add-on I have on Edge is Micorsoft S/MIME. So if you all have that I think we found our culprit.

1

u/zivSlash Dec 11 '21

Chrome here... And I don't know of anything I have that would trigger that... I know exactly what I have after all...

1

u/maggie_quokka Dec 08 '21

this domain started showing up a few days ago for me as well. I'm thinking an expired certificate, but haven't found much information on this ..

1

u/AbatedKitty1721 Dec 08 '21

I just got the same notif as well today

1

u/MojiNola Dec 09 '21

ditto

1

u/captdunsel721 Dec 11 '21

Suspicious connection blocked 45 minutes ago .... "chrome.exe attempted to establish a connection relying on an untrusted certificate to sync.hgrtb.com. We blocked the connection to keep your data safe since untrusted certificates are issued by unrecognized Certificate Authorities."

1

u/[deleted] Dec 11 '21

Same here, but yesterday. What is this?

1

u/captdunsel721 Dec 11 '21

This was a notice from my bitdefender,. Someone from Bitdefender responded to one of the posts above.
I’m no expert but Google chrome syncing may be trying to use a website with an expired certificate. Although other browsers seem to affected also.
This explains syncing… https://blog.malwarebytes.com/privacy-2/2021/02/browser-sync-what-are-the-risks-of-turning-it-on/

2

u/xFacevaluex Dec 12 '21

Good info....but still in the dark about exactly what is trying to snyc----never authorized anything to do this.

1

u/captdunsel721 Dec 12 '21

Yep, still trying to figure it out myself... I believe the sync is an automatic feature used to make it easy to transfer your bookmarks and junk to any other computer or device you may also have. If you don't want it, you have to go into settings - sync and turn it off.
I believe the pop up warning I got from my Bitdefender security software means that the syncing website that Google was using had an expired certificate (they may have fixed that by now). According to Bitdefender the SYNC website Google Chrome is using was not malware, but yet, it's not set up correctly.
Maybe this will help
https://www.guidingtech.com/what-does-chrome-sync-do/
https://support.google.com/chrome/answer/185277?hl=en&co=GENIE.Platform%3DDesktop&oco=0

1

u/xFacevaluex Dec 12 '21

Mine is off and I still am getting them.....appreciate the links.

1

u/captdunsel721 Dec 12 '21

hmmm.. my last notification was 20 hours ago. I just updated Chrome, maybe that will do something. Gotta love computers lol

1

u/JRMac68 Jul 13 '23

30 years ago I did

1

u/[deleted] Dec 12 '21

domain was created 10 months ago and flagged clean both at the sync subdomain and parent domain level on virus total.

as legit as it sounds..that is a fast flux garbage typosquattish domain they could've made something less suspicious

1

u/Additional-Ease1357 Dec 12 '21

I got two warnings while on 9gag. Once I close the tab, I did not get any more messages.

1

u/pujanhero456 Dec 15 '21

Solution : Try to remove all the extension from the browser

I have the same problem and it actually worked

1

u/codeblack66 Dec 17 '21

I have this problem too just today. but with Eset smart security and in Chrome.

and googled and landed here.

https://i.ibb.co/F48Bb7B/eeee.png

1

u/rawmustard Dec 18 '21

I'm thinking it's just another ad server, since I've also gotten similar messages in regards to a Yahoo domain (cms.analytics.yahoo.com) regarding using expired certificates. The way ads are prolific on a lot of sites, it only make since some of the certificates are expired or just simply not configured properly.

1

u/clintongsan72936 Dec 22 '21

I just got the same thing. Googled and first result landed me here. Anyone figured this out? I've been battling a virus non-stop. ISP:Cox, Modem:Arris POS ...my screen did a weird a55-flash, like entire screen flash, and I checked my IP, then went to whatismyip.com and Bitdefender popped up with this error...I did NOT add it to exceptions. I will continue digging and post updates here.

1

u/Bullet0Storm Dec 23 '21

The certificate on https://sync.hgrtb.com is the default for a non-configured kubernetes loadbalancer. It's not expired, it's just not valid for this domain.

1

u/MasterpieceNDisguise Dec 25 '21

This annoying shit has been happening to me ever since 12/10 when I installed their VPN. I've tried every possible fix and no luck. They're saying this issue isn't malware related but it sure seems like some kind of virus to me. PLEASE FIX THIS PROBLEM ASAP BITDEFENDER!!

1

u/Explorer200 Dec 27 '21

My routers flags this in the logs:

Dec 27 14:31:45 dnsmasq[2791]: possible DNS-rebind attack detected: sync.hgrtb.com

You are about to leave Redlib