Findprivate.online

The Findprivate.online domain may be spotted by users who have been compromised by a browser hijacker extension. The Findprivate.online domain is associated with browser extensions like 'FP App' that are promoted via pornographic sites and questionable URL shortening services. The Findprivate.online domain is associated with fake search engines that redirect users to promotional materials and gather relevant system information to help advertisers identify your machine on supported pages. The Findprivate.online domain serves as a redirect-gateway to h[tt]ps://searcholive.com/index_en2.php?q=[search terms] that is loaded after users enter search terms in Google Chrome's omnibox and hit enter.

The 'FP App' browser extension is reported to appear in Web browsers when users follow on-screen instructions to install a video codec and sponsored extension if they want to view protected content on the Web. The 'FP App' extension is hard to find on the Chrome Web Store and can be installed using direct URLs only. The 'FP App' application is said to be installed to at least six hundred browsers and change the user's default search engine to Findprivate.online. Searches made through the omnibox appear to load suggestions by 'Safe Search' and redirect Web surfers to h[tt]ps://searcholive.com/index_en2.php?q=[search terms]. The landing page at Searcholive.com may be styled to look like the legitimate Google.com site, but you should not use it to log into your Google account. It is possible that Searcholive.com may record your input and your Google account may be hijacked. The 'FP App' extension may add a blank icon to your browser's navigation panel and may plant persistent tracking cookies. You should consider using a reliable cyber security product if you wish to clean your browser and remove the 'FP App' extension completely. The Findprivate.online gateway and the 'FP App' extension are known to communicate with servers on the 104.27.170.166 and the 104.27.171.166 IP addresses. AV engines may mark resources related to the aforementioned IP addresses using the following names:

Artemis!B331734FE2F7
HTML.Z.Agent.2337
HTML/Phish.AHZ
HTML/Phishing.Agent.FU
HTML:PhishingMS-O [Phish]
HTML_MALPHISH.TICOGBM
Trojan.GenericKD.40240606
Trojan.KKGJ-8
Trojan:Win32/Bitrep.A
W32/Kryptik.FHIS!tr
Win32/Trojan.56b