Strange Popup in Browser Does anyone knows what is this, where it comes from and how to fix it? It shows up randomly and rare.



URL:
data:text/html;base64,PG1ldGEvaHR0cC1lcXVpdj1yZWZyZXNoIGNvbnRlbnQ9MDt1cmw9aHR0cDovL2FkY2xpY2suZy5kb3VibGVjbGljay5uZXQvcGNzL2NsaWNrP2FkdXJsPWh0dHBzJTNBJTJGJTJGc2VydmljZW9wZXJhdGl2ZS5jb20lMkZwYWdlJTJGJTNGZnh0NENYWHI4OUJmVXdjVUdUSjRiNlVERD4=.
Are you navigating the same site when this appears?
Is it a sketchy one?

If so, it is most likely a failed scammer ad.

Solution: Don't navigate that page anymore.

If not, then it is most likely an extension. To remove follow these instructions:  Install and manage Safari extensions on your Mac or


Go to Safari > Preferences > Extensions
Click extension on left
Click the uninstall button below the Extension name on the right box
Repeat for all extensions




Other information:

As stated in the comments:

data:text/html;base64,PG1ldGEvaHR0cC1lcXVpdj1yZWZyZXNoIGNvbnRlbnQ9MDt1cmw9aHR0cDovL2FkY2xpY2suZy5kb3VibGVjbGljay5uZXQvcGNzL2NsaWNrP2FkdXJsPWh0dHBzJTNBJTJGJTJGc2VydmljZW9wZXJhdGl2ZS5jb20lMkZwYWdlJTJGJTNGZnh0NENYWHI4OUJmVXdjVUdUSjRiNlVERD4=.


is in base64 and decodes to 

&lt;meta/http-equiv=refresh content=0;url=http://adclick.g.doubleclick.net/pcs/click?adurl=https%3A%2F%2Fserviceoperative.com%2Fpage%2F%3Ffxt4CXXr89BfUwcUGTJ4b6UDD&gt;


The meta/http-equiv=refresh content=0 tells the browser to redirect the following url in 0 seconds (immediately).

The link further decodes (url decode) to 

http://adclick.g.doubleclick.net/pcs/click?adurl=https://serviceoperative.com/page/?fxt4CXXr89BfUwcUGTJ4b6UDD


This is obviously an ad service. https://serviceoperative.com is most likely who is gaining $$ from link views. adclick.g.doubleclick.net is an ad service usually used by sketchy sites.

Both:

http://adclick.g.doubleclick.net/pcs/click?adurl=https://serviceoperative.com/page/?fxt4CXXr89BfUwcUGTJ4b6UDD

and https://serviceoperative.com/page/?fxt4CXXr89BfUwcUGTJ4b6UDD

redirect to google.com



Sidenote:

https://serviceoperative.com has got to have the worst security practices know to earth.

Their homepage requires a login by using CSS to blur the background and prompt for a login:



The CSS specifically is 

 -webkit-filter: blur(5px);-webkit-transition-property: -webkit-filter;-webkit-transition-duration: .4s;


By deleting the CSS and the login page from Inspect Element you can bypass the entire login system, which, of course I did.

Here are the peoples homepage that are trying to make money of scamming innocent people.



Seems to be some kind of database of all ads.  Gonna give the company and a quick chat.