System Alert for msfirewall.xyz on Sonoma 14.6.1

I also get this and I have no idea how it started happening. Do this though:

If you're receiving desktop notifications on Safari from an unknown website, it means a site you visited recently has likely requested permission to send notifications, which you might have accidentally allowed; to stop these notifications, go to your Safari settings, navigate to the "Websites" tab, then "Notifications" and block the specific website causing the issue by selecting "Deny" next to its domain.

The msfirewall.xyz appears to a Bad Actor software for Microsoft Windows and actually maybe a Malware or Adware

Thanks to a long standing contributor @John Galt 

Stop unwanted Notifications

Phony "tech support" / "ransomware" popups and web pages

android_stan wrote:

What precisely helped you remove this adware (if that is what this is) from your Mac? Could you outline the steps?

Check the “Stop unwanted notifications” link from the reply above.

Thanks - I think your advice fixed may have fixed my problem with the msfirewall.xyz.

I should have been more specific. I am not getting any unwanted pop-up notifications. Instead, when I click on the on the "On Mac, you can install BSD-DB using homebrew" link on this website (https://pypi.org/project/Gutenberg/), I am redirected to the following website:

https: {remove space} //msfirewall {dot} xyz/o/6/?clickid=ct3quft00fes739p8v60&lp_key=173274d12c7e46c70f263a931108ebf5d528751467&t1=460127105&t2=2&t3=0.031&t4=1&t5=1&key=b11cc307f58a47c4fb27&trk=cropclk.xyz&fdd=347cf82c547f4a778836af6785e376bc&vpb=BPBwFZBDF1sutcsNWFDeP9TjTfBCyEB9exwRrJW2pXAEyZUWXdmv8QQ_8qgPJ4OJ-RpUoPqjMhAo8mL_qom0TCE#

Also, it is redirected via another website — dyetui {dot} com. I have attached a screen grab from the msfirewall website below. My guess is there is some script which executes when I click on that specific link? Is there any way to find and delete whichever script leads to this behavior?

I just went to the Notifications & Focus section and turned off the "allow notifications" tab. I am sure this will turn off the notifications I am seeing, but I am still wondering if there is anything else I need to do to make certain this is not causing or allowing a bigger problem to occur in the future.

Hello .. I am new to this forum and unfortunately I have that annoying msfirewall popup as well and would like to remove whatever is allowing it to remain active if possible. Is someone able to tell me the steps I can follow so I can remove it and not just deny it permission to send the pop ups?

While reviewing websites that my child had visited on their computer, I came across the link that I opened on my computer.

Upon opening it, I was immediately redirected to the msfirewall.xyz site mentioned in this thread. Since then, I have been receiving unwanted notifications from msfirewall.xyz.

Interestingly, the first time I accessed that peterhuman.net link, I don’t recall seeing Safari's usual request to allow notifications (after redirects it made) from msfirewall.xyz. This was surprising, especially since I was specifically auditing questionable sites my child might have visited and would never intentionally approve any permissions to such websites.

When I revisited the same peterhuman.net link on the same computer, Safari did display the standard dialog to grant or deny notification permissions msfirewall.xyz. If I denied the request, the permission remained blocked as expected.

Given that I’m not the only one who is suddenly receiving these unsolicited notifications, I wonder if certain websites are exploiting a loophole in Safari’s notification permissions. For reference, I’m using Safari Version 18.1 (20619.2.1).

[Edited by Moderator]

What precisely helped you remove this adware (if that is what this is) from your Mac? Could you outline the steps?

Okay never mind — I think it may be the link embedded in the Project Gutenberg PyPi website. The correct link to homebrew is brew.sh and not homebrew.sh!

I did this as well. I also cleared the history in Safari. I restarted my MacBook and that seemed to solve the problem.