Suspicious files that keep re-propagating

[Speed38]

While checking Sys Settings > Notifications on my 2020 iMac, macOS 15.2, I noticed an entry with a Safari icon titled www.onsecrethunt.com. Reserch reveals an IT firm based in Baltana, Zirakpur, plus a bunch of other obscure sites.

I used Find Any File and found the file here; Users:bobg:Library:Caches:com.apple.Safari:RemoteNotifications:

I deleted it that file and folder, did a restart, checked Sys Settings > Notifications and it still appears at the bottom of the listings and the folder and file are once again back at Users:bobg:Library:Caches:com.apple.Safari:RemoteNotifications

I also found in Sys Settings > Notifications the following - to me suspicious - entries, also associated with a Safari icon:
toolbox.easeus.com
www.easeus.com
www1.notifpushback.com

Easus.com appears to be associated with a recovery wizard and one comment on reddit notes: EaseUs is a program that exists, works, but it does fall on the mal-ish side in terms of some of the exe's, access, and my god there marketing alone makes you believe you've been scammed since they call all the time, email, and then charge you constantly.

Re notifpushback.com returns [Site cannot be reached] and a reddit commentator noted: you allowed notifications from a malicious website. you need to go to your chrome settings and disable notifications from any website that you don't recognize. It looks like these are coming from notifications-news[.]com

I checked Safari > Settings > Notifications and the only entry there is Synology.

I deleted all three, restarted, and just like the onsecrethunt file and folder, they “repropogated” and are back in Users:bobg:Library:Caches:com.apple.Safari:RemoteNotifications

I do not know where these came from and would like to permanently delete them.

Any guidance on how to do so would be deeply appreciated.

 

[HobeSoundDarryl]

I had the same issue with notifications entries showing the Safari icon but are websites I know I have not visited. There were many entries for the same entity differing only with a counter like entity15, entity16, etc. Via some help in another thread, I deleted all of the notifications approved in Safari, Websites (tab), Notifications but these odd ones still showed in System Settings, Notifications... so I thought there was nothing that could be done since Apple doesn't offer a way to DELETE entries in System Settings, Notifications (for some unknown reason).

However, I just rechecked to share this post and now all of those are gone from System Settings, Notifications. In fact, there are NONE with a Safari icon showing there now. I don't know what actually worked as the efforts were a few weeks ago and I only just discovered them now gone today.

A (wild) guess is that select items either approved or even "deny" in Safari, Websites, Notifications are false and/or able to somehow inject notifications into System Settings, Notifications... and/or there may be a bug that doesn't fully contain Safari Notification approvals to only Safari but offer some way to System Notifications. Since I purged all notifications from Safari Notifications, I probably purged whichever one(s) by other names were able to inject the notifications into System Settings, Notifications. But that's only a wild guess.

All I can offer is that purging them from Safari Notifications definitely did not take effect immediately but some unknown time later, during which I fully rebooted the system probably a few times, etc.

 

[Speed38]

I had the same issue with notifications entries showing the Safari icon but are websites I know I have not visited. There were many entries for the same entity differing only with a counter like entity15, entity16, etc. Via some help in another thread, I deleted all of the notifications approved in Safari, Websites (tab), Notifications but these odd ones still showed in System Settings, Notifications... so I thought there was nothing that could be done since Apple doesn't offer a way to DELETE entries in System Settings, Notifications (for some unknown reason).

However, I just rechecked to share this post and now all of those are gone from System Settings, Notifications. In fact, there are NONE with a Safari icon showing there now. I don't know what actually work as the efforts were a few weeks ago and I only just discovered them now gone today.

Thanks for that feedback. As I noted, there is one lonely entry in Safari, Websites (tab), Notifications and that is for my router, Synology.

It is interesting to note that you now have nothing in Sys Settings > Notifications with a Safari icon. I have seven, legit ones like: voice.google.com, forums.macrumors.com, www.newegg.com BUT none of these appear under Safari, Websites (tab), Notifications. It really is bizarre. What a mess.

 

[HobeSoundDarryl]

The ones that were showing in System Settings, Notifications did NOT show in Safari, Notifications. But I suspect maybe one seemingly legit one in Safari may have been injecting these others in System Settings, Notifications. No way to know but I definitely think a "delete notification" seems like an obvious functionality thing for System Settings, Notifications entry instead of only OFF or ON, etc.

 

[nmt1900]

Do a right click on correct item in System Settings -> Notifications and select "Reset Notifications".

P. S. On Monterey and earlier same was doable by hitting Backspace key after selecting the item in System Preferences -> Notifications

 

[Speed38]

Do a right click on correct item in System Settings -> Notifications and select "Reset Notifications".

P. S. On Monterey and earlier same was doable by hitting Backspace key after selecting the item in System Preferences -> Notifications

Thanks so very much that advice which I followed for all those offending files. Since I have your attention, any idea why of how those the files and folders associated with those notifications “repropogated” following a restart and appear again in Users:bobg:Library:Caches:com.apple.Safari:RemoteNotifications?