Is ff.alwaysecuredhub.com safe?
http://ff.alwaysecuredhub.com/
Checked on
How we checked
Coverage: strong · 5 of 6 applicable core capabilities
- Antivirus (59 of 93 engines answered) · saved result: did not fully complete
- Google Safe Browsing: completed
- page reading: completed
- page capture: completed
- domain records: completed
- web research: completed
A month-old site pushing a browser extension that its own terms admit will switch your default search engine to a sponsored one
ff.alwaysecuredhub.com is a contact page for 'Always Secured By Securely', an extension whose terms name INTANGO LTD of Tel Aviv as the provider. The page sells nothing — the only action is an 'Install' button — and the operator's own EULA states that installing the extension changes Chrome's default search engine to a sponsored engine. Independent security write-ups describe Intango extensions redirecting search traffic through a proxy, and one saved antivirus engine labels this host as malware. That combination of a disclosed search-hijack mechanic, adverse third-party reporting and a 30-day-old domain puts the site in the High Risk band.
Saved site captureCaptured safely during this scan2 antivirus engines flagged this URLVIPRE, GridinsoftSaved antivirus result from Nov 4, 2026Where this site sits
- Dangerous1–20
- High Risk21–44
- Moderate Risk45–69
- Low Risk70–84
- Safe85–100
The score combines saved evidence strength and analysis quality. Coverage is reported separately.
Why 30/100
High Risk covers scores 21–44. 8 findings pulled the score down; 2 pushed it up.
What pulled the score down
- Strong1 independent antivirus family reported an adverse result. This comes from a saved antivirus observation rather than a new submission, so treat the detection as real but confirm the timing.
- ModerateThe operator's own EULA states that installing the extension changes Chrome's default search engine to a sponsored search engine.
- Moderate5 independent sources carry complaints or warnings about this site, including: "They attributed 111 extensions with a combined total of around 2.2 million installations to Intango LTD."
- Moderate5 independent sources carry complaints or warnings about this site, including: "Once installed, they quietly change the browser’s default search engine to route all traffic through a proxy server."
- Moderate5 independent sources carry complaints or warnings about this site, including: "The investigation, published by Socket, adds 264 newly identified extensions accounting for another 8.7 million users to earlier research."
- Moderate5 independent sources carry complaints or warnings about this site, including: "Siden er knyttet til browser hijacker-programmet Always Secured powered by Yahoo"
- Moderate5 independent sources carry complaints or warnings about this site, including: "Gridinsoft 目前将该网站归类为可疑网站。报告重点展示1 个黑名单命中, 一个非常新的域名（21 天）,和尚无稳定的公开用户评价历史。"
- MinorThe registrable domain is 30 days old.
What pushed the score up
- SupportsThe browser threat feed returned no threat warning and the hosting IP has an abuse confidence score of 0/100 across three saved reports.
- SupportsThe terms name INTANGO LTD of Tel Aviv, the site lists a domain-matching contact address and a postal address, and uninstall instructions are published.
No points per finding are stored for this report: our analysis weighed all findings together to set the score. Each finding shows its saved severity instead (Decisive, Strong, Moderate or Minor).
Lost money or shared details on ff.alwaysecuredhub.com? Do this now
Act quickly: the first hours matter most for a chargeback.
- Call your bank or card issuer now
Ask them to dispute the charge or open a chargeback; the sooner you act, the better your odds. Card payments can often be reversed. Bank transfers and gift cards are harder, but report them to your bank too. Crypto payments usually cannot be reversed: report the wallet address and transaction ID to the exchange you sent from.
- Change any password you entered
If you entered a password on ff.alwaysecuredhub.com, change it there and anywhere you reused it, and turn on two-factor authentication. Keep screenshots, order confirmations and messages as evidence.
- Report the site
Reports help get scam sites taken down faster and warn other people.
- Report the domain to its registrar
NameCheap, Inc. takes abuse reports at abuse@namecheap.com (+1.6613102107). Include the address and what happened.
- Ignore anyone offering to recover your money
"Recovery" services or agents who contact you, or ask for a fee up front, are almost always a second scam aimed at victims. Your bank's dispute process and the official reporting services never charge a fee in advance.
Full answers about refunds and reporting are in the Safety FAQ below.
01 · Investigation Brief
Investigation Brief
ff.alwaysecuredhub.com is a contact page for 'Always Secured By Securely', an extension whose terms name INTANGO LTD of Tel Aviv as the provider. The page sells nothing — the only action is an 'Install' button — and the operator's own EULA states that installing the extension changes Chrome's default search engine to a sponsored engine. Independent security write-ups describe Intango extensions redirecting search traffic through a proxy, and one saved antivirus engine labels this host as malware. That combination of a disclosed search-hijack mechanic, adverse third-party reporting and a 30-day-old domain puts the site in the High Risk band.
The install button changes your search engine, by the operator's own admission
The site's only real call to action is a green 'Install' button in the header, repeated in the navigation and footer. There is no price, cart, checkout or payment field anywhere on the rendered page, so the product is not being sold to you directly.
The terms spell out what happens next: 'by installing our Extension/Product, the Extension/Product will change your Chrome browser's default search engine to a sponsored search engine', with instructions for resetting it. That is the business model — your searches become referral traffic — and it is disclosed only in the legal text, not on the install page.
Independent reporting on the named provider describes the same pattern at scale: one write-up attributes 111 extensions with roughly 2.2 million installs to Intango LTD, and another describes extensions that 'quietly change the browser's default search engine to route all traffic through a proxy server'. A further report adds 264 newly identified extensions covering another 8.7 million users.
A separate vendor page ties the 'Always Secured powered by Yahoo' product to browser-hijacker behaviour, and a Chrome Web Store listing for that extension is registered to an admin address on a different domain (alwayssecured.net) than the one this site uses.
Mixed technical signals and a very young domain
The saved antivirus aggregate records one malicious result (VIPRE) and one suspicious result (Gridinsoft) for this host, and Gridinsoft's own page classifies the site as suspicious, citing a blacklist hit, a domain only weeks old and no stable public review history. A second Gridinsoft page describes a related host as classified for phishing. These are saved observations rather than a fresh submission, so treat them as real but dated.
Against that, the browser threat feed returned no threat warning, the hosting IP carries an abuse confidence score of 0/100 across three saved reports, and a valid TLS certificate exists. The scanned address itself was served over plain HTTP with no redirect to HTTPS, so the connection to it was not encrypted.
The registrable domain alwaysecuredhub.com is 30 days old. The provider is named in the terms as INTANGO LTD, a company registered in Israel with offices at 38 Habarzel St., Tel Aviv, and contact is a domain-matching address, admin@alwaysecuredhub.com, alongside a postal address on the page. No company registration number is published, and the contact form endpoint failed to load during review.
Why the score is 30
The operator's own EULA states that installing the extension changes Chrome's default search engine to a sponsored search engine.
02 · Security Evidence
Security evidence
Antivirus Engines
2/ 93
detectionsSaved analysis from November 4, 2026 - stale
2 engines flagged this URL
Every saved adverse engine is listed below. The full provider matrix remains available for audit.
- Malicious
- 1
- Suspicious
- 1
- Total
- 93
| Engine | Finding |
|---|---|
| VIPREMalicious | malware |
| GridinsoftSuspicious | suspicious |
All 93 engine results
- VIPRE - malware - Malicious
- Gridinsoft - Suspicious
- 0xSI_f33d - Unrated
- Abusix - Clean
- Acronis - Clean
- ADMINUSLabs - Clean
- AILabs (MONITORAPP) - Clean
- AlienVault - Clean
- alphaMountain.ai - Unrated
- AlphaSOC - Unrated
- Antiy-AVL - Clean
- ArcSight Threat Intelligence - Unrated
- AutoShun - Unrated
- Bfore.Ai PreCrime - Unrated
- BitDefender - Clean
- Bkav - Unrated
- BlockList - Clean
- Blueliv - Clean
- Certego - Clean
- ChainPatrol - Unrated
- Chong Lua Dao - Clean
- CINS Army - Clean
- CRDF - Clean
- Criminal IP - Unrated
- CSIS Security Group - Unrated
- CTX AI - Clean
- Cyan - Unrated
- Cyble - Clean
- CyRadar - Clean
- desenmascara.me - Clean
- DNS8 - Unrated
- Dr.Web - Clean
- EmergingThreats - Clean
- Emsisoft - Clean
- Ermes - Unrated
- ESET - Clean
- ESTsecurity - Clean
- Forcepoint ThreatSeeker - Clean
- Fortinet - Clean
- Fortra - Unrated
- G-Data - Clean
- GCP Abuse Intelligence - Unrated
- Google Safe Browsing - Clean
- GreenSnow - Clean
- GreyNoise - Unrated
- Guardpot - Unrated
- Heimdal Security - Clean
- Hunt.io Intelligence - Unrated
- IPsum - Clean
- Juniper Networks - Clean
- K7AntiVirus - Unrated
- Kaspersky - Clean
- LevelBlue - Clean
- Lionic - Clean
- Lumu - Unrated
- Malwared - Clean
- MalwarePatrol - Clean
- MalwareURL - Unrated
- Mimecast - Unrated
- Netcraft - Unrated
- OpenPhish - Clean
- Orcapot - Unrated
- PhishFort - Unrated
- Phishing Database - Clean
- Phishtank - Clean
- PREBYTES - Clean
- PrecisionSec - Unrated
- Quick Heal - Clean
- Quttera - Clean
- Rising - Clean
- SafeToOpen - Unrated
- Sangfor - Clean
- Sansec eComscan - Unrated
- Scantitan - Clean
- SCUMWARE.org - Clean
- Seclookup - Clean
- Snort IP sample list - Unrated
- SOCRadar - Unrated
- Sophos - Clean
- StopForumSpam - Clean
- Sucuri SiteCheck - Clean
- Synthient - Unrated
- ThreatHive - Clean
- URLhaus - Clean
- URLQuery - Unrated
- Viettel Threat Intelligence - Clean
- ViriBack - Clean
- VX Vault - Clean
- Webroot - Clean
- Xcitium Verdict Cloud - Unrated
- Yandex Safebrowsing - Clean
- ZeroCERT - Clean
- ZeroFox - Unrated
How security vendors categorise this site
- Forcepoint ThreatSeekernewly registered websites
- Googletechnology
Each vendor’s own label for the site, saved with the antivirus result. Labels are separate from the engine verdicts above and can disagree with each other.
Security Scans
Checked against the browser threat feeds available to this scan — no hit.
What we observed
Visual context from the captured page
Rendered page shows a 'Contact us' heading with two cards: 'Help & Support' with a green 'Send us Feedback' button and 'Data Privacy' with a green 'Contact data team' button. Top navigation shows Privacy, Terms, Contact, Uninstall links and a prominent green 'Install' button; footer repeats Terms, Contact, Privacy, Uninstall under 'IMPORTANT LINKS'. Logo is a green shield with a smiley face next to the wordmark 'Always Securec By Securely'; footer tagline reads 'A friendlier 60-minute search session, one click away.' No price, cart, checkout, payment fields, or subscription terms are visible anywhere on the rendered page.
What the captured page showed
4 observations- 01
Rendered page shows a 'Contact us' heading with two cards: 'Help & Support' with a green 'Send us Feedback' button and 'Data Privacy' with a green 'Contact data team' button.
- 02
Top navigation shows Privacy, Terms, Contact, Uninstall links and a prominent green 'Install' button; footer repeats Terms, Contact, Privacy, Uninstall under 'IMPORTANT LINKS'.
- 03
Logo is a green shield with a smiley face next to the wordmark 'Always Securec By Securely'; footer tagline reads 'A friendlier 60-minute search session, one click away.'
- 04
No price, cart, checkout, payment fields, or subscription terms are visible anywhere on the rendered page.
What the page says about itself
Quoted from the pages we read: the site's own words, not our findings.
- Page title
Contact Us | Always Secured By Securely
Pages we read
- Main page/contact/Read
- Terms/terms/Read
- Contact page/contact/contact-form.phpCould not be read
03 · Investigation Story
Investigation story
What the site claims
Contact Us | Always Secured By Securely
What we observed
The page content was captured and checked alongside 59 antivirus results.
What independent research found
8 external findings were saved and compared with the page evidence.
What remains unverified
1 of the 6 applicable core capabilities did not complete, so those gaps remain visible in the coverage ledger.
What kind of site and risk is this?
Threat category
Aggressive Ads & Malvertising
Service and business model
Saas
Observed behavior
Evidence behind this classification
- 01The operator's own EULA states that installing the extension changes Chrome's default search engine to a sponsored search engine.
- 02The rendered page shows no price, cart, checkout, payment fields or subscription terms; the only commercial action is the Install button.
- 03The registrable domain is 30 days old.
If this is a scam — what it means for you
What happens after you click Install
A visitor who clicks the 'Install' button accepts the EULA and gets an extension that replaces the browser's default search engine with a sponsored one, so every subsequent search is routed to a destination chosen by the operator rather than by the user.
If this is a scam, how it works
The evidence-backed path
Each stage below is preserved from the grounded analysis and linked to saved evidence.
Reporting on this provider's extension family describes the same step as routing search traffic through a proxy server, which means the queries themselves pass through operator-controlled infrastructure.
The site does publish uninstall instructions and a contact address for questions, complaints and claims, so removal is documented — but the change is made silently at install time, not as a visible choice.
Do not install this extension. If it is already on your browser, remove it and reset your default search engine to the one you actually want, then check your browser's extension list for other add-ons you did not deliberately add. The site's own terms confirm the search-engine change, and independent reporting on the same provider describes search traffic being routed through a proxy.
Web research findings
Independent findings for ff.alwaysecuredhub.com, including public complaints, named review sources, registration records, and look-alike-domain evidence.
- Gridinsoftopen
"Gridinsoft 目前将该网站归类为可疑网站。报告重点展示1 个黑名单命中, 一个非常新的域名（21 天）,和尚无稳定的公开用户评价历史。"
- Gridinsoft (citing VIPRE via VirusTotal)open
"VIPRE Malware Ff.alwaysecuredhub.com 的外部提供方结果，最后检查时间：2026年10月27日。"
- Gridinsoftopen
"Gridinsoft blocks this website because it was classified as phishing."
- NYDUS.orgopen
"They attributed 111 extensions with a combined total of around 2.2 million installations to Intango LTD."
- HazeTecopen
"Once installed, they quietly change the browser’s default search engine to route all traffic through a proxy server."
Reputation Sources
How this domain rates across independent threat-intelligence and blocklist providers.
04 · Domain & Infrastructure
Domain & infrastructure
The plumbing behind the site — who registered it, how it’s encrypted, where it’s hosted, and where it links out. A valid certificate or a calm server doesn’t mean the business is honest — scam sites pass these checks too.
Infrastructure map
- Domainff.alwaysecuredhub.com
- Redirects toalwaysecuredhub.com
- Hosted byCloudflare, Inc.
- Referencesfonts.googleapis.com · fonts.gstatic.com
Domain Timeline
- Oct 6, 2026Domain registered
First appeared in WHOIS records — 30 days old when this review was saved.
- Nov 6, 2026Saved security review — Rated High Risk
The completed checks from this saved scan are detailed above.
ff.alwaysecuredhub.com was registered very recently when this review was saved and was already flagged. Freshly-registered domains are disproportionately used for scams, and a young domain with active threat signals warrants extra caution.
Contact Verification
Saved contact details can help identify the operator. Their presence supports traceability; it does not prove the business is trustworthy.
- Contact email on the site's own domain (admin@alwaysecuredhub.com).
- Postal address visible on the page.
Domain & Encryption
Cloudflare DNS is used by legitimate and scam sites alike, so it does not identify who runs the site.
Report this domain to its registrar: send the address and what happened to this contact.
A certificate issued weeks or days before the scan on a domain registered recently is common on short-lived sites, though new legitimate sites look the same.
Certificate issued for alwaysecuredhub.com.
A shared Cloudflare address answers for many sites, so it is not the site's own server and says nothing about who runs it.
Analytics and ads
- Cloudflare Web Analytics
Scripts, fonts and CDNs
- Google Fonts
- cdnjs
Payment providers the page loads
None seen among the outside domains we saved.
Read from the first 20 outside domains the page loads and the shop platform it uses; the web server and platform rows are under Hosting & Technology. A payment script on the page does not prove the shop accepts that method at checkout, or that you are protected.
Redirect Chain
- 1302http://ff.alwaysecuredhub.com/
- 2301https://alwaysecuredhub.com/contact
- 3200http://alwaysecuredhub.com/contact/
Server Reputation
Referenced Domains
Outbound domains this page links to or loads resources from. Each links to its own security scan.
05 · Evidence Ledger
Evidence ledger
- Antiviruspartial
- Browser threat feedcomplete
- Page contentcomplete
- Analysiscomplete
- Visual evidencecomplete
The conclusion is supported by the evidence saved with this report.
Technical threat
suspiciousMalware, phishing, credential theft and hostile infrastructure.
1 independent antivirus family reported an adverse result. This comes from a saved antivirus observation rather than a new submission, so treat the detection as real but confirm the timing.
Operator / customer risk
suspiciousComplaints, withdrawals, business conduct and commercial traps.
The operator's own EULA states that installing the extension changes Chrome's default search engine to a sponsored search engine. · 5 independent sources carry complaints or warnings about this site, including: "They attributed 111 extensions with a combined total of around 2.2 million installations to Intango LTD."
Source coverage and freshness
Status shows whether usable evidence was saved; finding shows what that evidence observed.
| Source | Result | Completion | Finding | Freshness |
|---|---|---|---|---|
| Antivirus | 2 of 93 engines flagged | Limited | Adverse | stale fallback · analysed Nov 4, 2026 |
| Browser protection | No browser threat-list match | Completed | No adverse finding | this scan · Nov 6, 2026 |
| Page content | Page fetched · HTTP 200 | Completed | No adverse finding | this scan · Nov 6, 2026 |
| Visual evidence | 4 visible observations saved with the page capture | Completed | No adverse finding | this scan · Nov 6, 2026 |
| Independent research | 8 independent findings were saved | Completed | Adverse | this scan · Nov 6, 2026 |
- Antivirus
- Result2 of 93 engines flagged
- CompletionLimitedFindingAdverse
- Freshnessstale fallback · analysed Nov 4, 2026
- Browser protection
- ResultNo browser threat-list match
- CompletionCompletedFindingNo adverse finding
- Freshnessthis scan · Nov 6, 2026
- Page content
- ResultPage fetched · HTTP 200
- CompletionCompletedFindingNo adverse finding
- Freshnessthis scan · Nov 6, 2026
- Visual evidence
- Result4 visible observations saved with the page capture
- CompletionCompletedFindingNo adverse finding
- Freshnessthis scan · Nov 6, 2026
- Independent research
- Result8 independent findings were saved
- CompletionCompletedFindingAdverse
- Freshnessthis scan · Nov 6, 2026
07 · Safety FAQ
Safety FAQ
Answered from the saved verdict and evidence in this report.
Is ff.alwaysecuredhub.com a scam or a legit site?
Is ff.alwaysecuredhub.com safe to use?
What is the risk from the ads and redirects on ff.alwaysecuredhub.com?
Why does ff.alwaysecuredhub.com open unrelated pages or pop-ups?
How do I stop the pop-ups or notifications from ff.alwaysecuredhub.com?
Has ff.alwaysecuredhub.com been flagged by antivirus engines?
Is ff.alwaysecuredhub.com on any phishing or malware blacklists?
How old is the ff.alwaysecuredhub.com domain?
Does ff.alwaysecuredhub.com have a valid SSL certificate?
Where is ff.alwaysecuredhub.com hosted?
How often is the ff.alwaysecuredhub.com report updated?
08 · Final Verdict
Final verdict
A month-old site pushing a browser extension that its own terms admit will switch your default search engine to a sponsored one
ff.alwaysecuredhub.com is a contact page for 'Always Secured By Securely', an extension whose terms name INTANGO LTD of Tel Aviv as the provider. The page sells nothing — the only action is an 'Install' button — and the operator's own EULA states that installing the extension changes Chrome's default search engine to a sponsored engine. Independent security write-ups describe Intango extensions redirecting search traffic through a proxy, and one saved antivirus engine labels this host as malware. That combination of a disclosed search-hijack mechanic, adverse third-party reporting and a 30-day-old domain puts the site in the High Risk band.
09 · Community
Community
Are you the owner of ff.alwaysecuredhub.com?Verify and reply