Recif.click ads: what it is and how to remove it

From our report of Oct 2022 · not reviewed since

The tricks used

Users often wouldn't purposefully visit websites that are inherently dangerous or provide no useful information or entertainment.

Scammers are aware of this fact, therefore, they need to make sure that visitors will visit their bogus websites in some way. Typically, rogue ad networks and dangerous websites are used to do this.

For instance, one of the most frequent reasons why people are led to Recif.click is clicking links on risky websites. In a similar manner, automatic scripts might start the redirect without users having to click any buttons. Adware may also be at blame in several other situations for this unexpected browser behavior.

Due to unexpected redirects, it is not surprising that users are more likely to be prone to be scammed - they pay less attention and are shown something unexpected. For instance, you may find one of the following messages after entering the push notification scam site:

Crooks are attempting to suggest that the "Allow" button has another function, such as verifying an individual's age or proving that they are not a robot.

Scammers are attempting to deceive users into thinking that this is simply another check used on many other websites, which is not the case here. When visitors click the "Allow" option, the Recif.click website will actually only be allowed to send push notifications whenever the browser is open.

• Just one more step! "Allow" to continue.
• Your file is ready to download. Press Allow to continue.
• Click Allow to confirm that you are not a robot.
• If you are 18+, click Allow.
• Can't play this video! Perhaps your browser doesn't allow video playback. Click the Allow button to watch the video.

From our report of Oct 2022 · not reviewed since

How to check the system for adware

Let's make one thing clear: you seeing push notifications that include dubious content does not mean you are automatically infected (as long as you don't interact with the produced links).

However, adware and other unwanted software could well be the reason you ended up on websites like Recif.click, Video-watch1.com, Milipili.click, Soltilid.live, and similar.

Rogue ad networks, malicious websites, and potentially unwanted programs are connected to each other, so if one has an encounter with one of these components, they are more likely to come across the other. Therefore, you should make sure you check your system for infections at once, and the easiest way to do so is by scanning your device with , , or another reliable anti-malware.

Of course, you could always look for unwanted apps yourself. If you choose to do so, make sure you check the installed extension list via your browser, as well as apps on your system. Here are the instructions for it:

To fully remove an unwanted app, you need to access Application Support, LaunchAgents, and LaunchDaemons folders and delete relevant files:

Finally, you should make sure that you clean your browser caches accordingly, as cookies and other tiny items within them may be used to track you, and information such as visited websites, links clicked, and similar data may continue to be collected by unknown third parties.

• Enter Control Panel into the Windows search box and hit Enter or click on the search result.
• Under Programs, select Uninstall a program.
• From the list, find the entry of the suspicious program.
• Right-click on the application and select Uninstall.
• If User Account Control shows up, click Yes.
• Wait till uninstallation process is complete and click OK.
• From the menu bar, select Go > Applications.
• In the Applications folder, look for all related entries.
• Click on the app and drag it to Trash (or right-click and pick Move to Trash)
• Select Go > Go to Folder.
• Enter /Library/Application Support and click Go or press Enter.
• In the Application Support folder, look for any dubious entries and then delete them.
• Now enter /Library/LaunchAgents and /Library/LaunchDaemons folders the same way and terminate all the related .plist files.

From our report of Oct 2022 · not reviewed since

Stop the intrusive Recif.click ads

While scanning the system with security software is definitely recommended under any circumstances whenever suspicious activity is encountered, it would not get rid of push notifications for you.

Since they are enabled by users themselves and are not a part of the malicious activity of some malware, they have to be disabled manually via browser settings. Proceed with the following instructions if you want to stop Recif.click ads at once:

Google Chrome (desktop)

Google Chrome (Android)

MS Edge (Chromium)

• Open the Google Chrome browser and go to Menu > Settings.
• Locate the Privacy and security section and pick Site Settings > Notifications.
• Look at the Allow section and look for a suspicious URL.
• Click the three vertical dots next to it and pick Block. This should remove unwanted notifications from Google Chrome.
• Open Google Chrome and tap on Settings (three vertical dots).
• Select Notifications.
• Locate the unwanted URL and toggle the button to the left (Off setting).
• Open Mozilla Firefox and go to Menu > Options.
• Click on Privacy & Security section.
• Under Permissions, you should be able to see Notifications. Click the Settings button next to it.
• In the Settings – Notification Permissions window, click on the drop-down menu by the URL in question.
• Select Block and then click on Save Changes. This should remove unwanted notifications from Mozilla Firefox.
• Open Microsoft Edge, and go to Settings.
• Select Site permissions.
• Go to Notifications on the right.
• Under Allow, you will find the unwanted entry.
• Click on More actions and select Block.
• Click on Safari > Preferences...
• Go to the Websites tab and, under General, select Notifications.
• Select the web address in question, click the drop-down menu and select Deny.
• Open Internet Explorer, and click on the Gear icon at the top-right of the window.
• Select Internet options and go to the Privacy tab.
• In the Pop-up Blocker section, click on Settings.
• Locate the web address in question under Allowed sites and pick Remove.

From our report of Oct 2022 · not reviewed since

More from our earlier report on Recif.click

• In order to block push notifications, access your browser settings.
• By running a scan with , you can check if your system is infected with malware or adware

From our report of Oct 2022 · not reviewed since

Recif.click is a fake website created by scammers that you may accidentally encounter online.

The main goal of the scam is to make people believe that subscribing to push notifications is nothing more than a regular verification process they need to confirm by pressing the "Allow" button within the prompt. To trick users, scammers use plenty of phishing techniques that may not be familiar to those affected.

The first time users see the name of Recif.click is when they notice suspicious pop-ups showing up outside of the browser window, on top of all the other apps. This activity is not only bothersome, but if links and messages are clicked, users may land on malicious websites where they could be deceived into paying for unnecessary services, downloading malicious software, or disclosing personal information to malicious parties.

We advise staying away from these pop-ups and instead disabling Recif.click push notifications using the web browser's settings, as we describe below. The affected are likely to be exposed to phishing and other hazardous content online, so it is strongly recommended to check the device for adware or other malware infections.