Whenwem.online ads: what it is and how to remove it
Whenwem.online is a malicious website that attempts to make visitors allow notifications into their machines using fraud. Upon site entry, users are immediately presented with a notification that aggressively asks to press the "Allow" button.
Facts checked October 6, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
If notifications from whenwem.online led you to download something, a free scan can check the PC for anything that came with it.
Do it yourself · free Remove Whenwem.online ads yourself 2 steps, about 6 minutes, no software needed.

Whenwem.online ads: summary
| Distribution | Push notifications are enabled soon after the permission in granted via the "Allow" button within a website prompt |
|---|---|
| Name | Whenwem.online |
| Type | Push notifications, scam, ads |
| IP address | 44.198.9.0 |
| Symptoms | pop-up ads show up on the desktop frequently |
| Dangers | Clicking on links that are embedded within the notification prompt, exploring the sites these links bring to, or downloading files can be dangerous – users can get infected with malware, suffer from financial losses, or disclose their private information to cybercriminals |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 9 more facts
| Detection names | No Microsoft detection name is known |
|---|---|
| Damage | Not recorded in the old report |
| Evidence | 4 write-ups by security sites; details still limited |
| Domains | whenwem.online |
| Ads shown as | Desktop notifications |
| Browsers | Chrome, Edge and Firefox |
| Installed on the PC | Nothing; a browser notification permission only |
| First seen | 23 August 2021 |
| Facts checked | 6 October 2026 |
What the Whenwem.online ads ads look like
Click "Allow" to confirm that you are not a robot!
Is Whenwem.online ads dangerous?
From our report of Aug 2021 · not reviewed since
Whenwem.online ads will not leave you alone until you deny them via browser settings
Whenwem.online is a malicious website that attempts to make visitors allow notifications into their machines using fraud.
Upon site entry, users are immediately presented with a notification that aggressively asks to press the "Allow" button. If this action is fulfilled, users would soon start seeping intrusive pop-ups appearing directly on their screen, regardless of MS Edge, Google Chrome, Mozilla Firefox, or any other browser is used. You might also encounter the same behavior on your Android device or iPhone.
These pop-ups are nothing that can be counted as secure. While some of the links might lead to relatively safe websites which advertise various software (for example, VPN), there are plenty of pages that might be extremely dangerous. Here are a few examples of what you should never click on:
If you are here because you don't know how to stop the annoying pop-ups, you came to the right place.
- Your computer is infected and you need to download "removal software";
- You won an expensive gift - all you have to do is enter your personal information to receive it;
- Get-rich-quick schemes: unrealistic job or investment offers;
- Promotion of various dubious software (usually, potentially unwanted programs), etc.
- Advertisements of gambling, adult-oriented, and similar high-risk sites.


From our report of Aug 2021 · not reviewed since
Why are you seeing the annoying ads?
Considering how intrusive the push notifications can be, many users might believe that their systems might be infected with a virus.
To make matters worse, many users don't know that they were tricked online. In any case, the situation can go both ways - there might or might not be a potentially unwanted program (or, in some cases, something more sinister) installed on your PC. It all depends on the situation, although you should never panic, as there is always a solution available.
In most cases, users are redirected to Whenwem.online or a similar website by accident. This typically happens when a link is clicked on another website or due to the URL redirection. Such behavior is typical to websites of dubious origin, including torrents, gambling, and similar sites. In fact, you might be redirected to several other pages before you land on this one.
Alternatively, you could have ended up on this malicious website due to adware - a type of potentially unwanted program which spreads using unfair tactics and focuses on delivering ads to users. Some more aggressive adware might also engage in browser redirects. Thus, if you see banners, deals, offers, coupons, in-text links, and similar ads frequently, you should definitely check your system for adware.
The easiest way to eliminate unwanted or malicious software from your system is by scanning it with powerful anti-virus software.
Alternatively, you can also refer to our instructions at the bottom of this article in order to delete PUPs manually. This choice is rather risky because some adware might be difficult to find and remove. Finally, you should also take care of your web browsers; cleaning them might take a while, so you could instead employ to do that for you automatically.
From our report of Aug 2021 · not reviewed since
Scam explained
Once you land on the destination page, the scam begins to take its shape.
For the scheme to work, crooks need to convince visitors that what they are clicking on is not what it actually is - and they use various tricks for that.
It is worth noting that the pop-ups themselves are not malicious; it is the contents of the notifications that frequently are. The feature is legitimate and is used by many websites around the internet. Those who are willing to receive information from the desired website can do so by allowing it to send them notifications.
However, when it comes to scam websites, everything changes, as users are not provided a fair explanation about what they actually agree to. Here is one of the examples or a message you might encounter upon accessing the Whenwem.online site:
You probably heard of captcha codes before (and struggled with those) - they are used to protect websites from being attacked by bots or from DDoS attacks. This feature is so frequently used that it is recognizable straight away. Threat actors want to make an impression that this is a simple verification process, while in reality, it is what it is - permission for the website to show notifications.
Scammers also use various other statements to trick people, including showing a fake video still, saying that the only way to close the window is by pressing the "Allow" button, etc. These tactics are particularly common and used by many similar malicious sites, including Lazyovertime.com, Eaddressor.top, Allhotfeed.com, and many others.

From our report of Aug 2021 · not reviewed since
How to deny Whenwem.online permission to show you ads
If you are seeing Whenwem.online ads regularly, you can remove them quite easily.
All you have to do is access the settings panel of your web browser and block the permission for the site to send you notifications.
Google Chrome (desktop):
Google Chrome (Android):
MS Edge (Chromium):
In some cases, problems might not go away even after performing these steps above. If that is the case for you, it is likely that there is an adware app installed on your system, and you knew nothing of it.
As we already mentioned, removing PUPs manually might be rather difficult, so you should instead rely on security software - it can also check whether malware is running in the background. Also, don't forget to clean your web browsers.
- Open Google Chrome browser and go to Menu > Settings.
- Locate Privacy and security section and pick Site Settings > Notifications.
- Look at the Allow section and look for a suspicious URL.
- Click the three vertical dots next to it and pick Block. This should remove unwanted notifications from Google Chrome.
- Open Google Chrome and tap on Settings (three vertical dots).
- Select Notifications.
- Locate the unwanted URL and toggle the button to the left (Off setting).
- Open Mozilla Firefox and go to Menu > Options.
- Click on Privacy & Security section.
- Under Permissions, you should be able to see Notifications. Click Settings button next to it.
- In the Settings – Notification Permissions window, click on the drop-down menu by the URL in question.
- Select Block and then click on Save Changes. This should remove unwanted notifications from Mozilla Firefox.
- Click on Safari > Preferences...
- Go to Websites tab and, under General, select Notifications.
- Select the web address in question, click the drop-down menu and select Deny.
- Open Microsoft Edge, and click the Settings and more button (three horizontal dots) at the top-right of the window.
- Select Settings and then go to Advanced.
- Under Website permissions, pick Manage permissions and select the URL in question.
- Toggle the switch to the left to turn notifications off on Microsoft Edge.
- Open Microsoft Edge, and go to Settings.
- Select Site permissions.
- Go to Notifications on the right.
- Under Allow, you will find the unwanted entry.
- Click on More actions and select Block.
- Open Internet Explorer, and click on the Gear icon at the top-right on the window.
- Select Internet options and go to Privacy tab.
- In the Pop-up Blocker section, click on Settings.
- Locate web address in question under Allowed sites and pick Remove.
From our report of Aug 2021 · not reviewed since
More from our earlier report on Whenwem.online
- Redirects and ads might indicate adware infection, so you should check your system with anti-malware.
Check your browser and PC
- Address:
whenwem.online
How to remove Whenwem.online ads
How to stop Whenwem.online notifications
Do this in every browser you use, and in every profile inside it: each keeps its own list of sites allowed to send notifications.
Nothing has to be uninstalled for the notifications themselves.
Which browser shows the ads?
Step 1: Remove whenwem.online from Chrome's notification list
Open More (the three dots) > Settings > Privacy and security > Site settings > Notifications, or paste
chrome://settings/content/notificationsinto the address bar.Under Allowed to send notifications, open the menu next to
whenwem.onlineand choose Remove or Block, and do the same for any other address you do not recognise.Next to Not allowed to send notifications, click Add and enter whenwem.online, so the site cannot ask again. The menus are the same in Chrome on Windows 11 and Windows 10, and each Chrome profile keeps its own list.

Chrome on Windows 11: Settings > Privacy and security > Site settings > Notifications. Full procedure with screenshots: Stop website notifications and pop-ups
Instructions for Google Chrome
Remove from Google Chrome
Delete malicious extensions from Google Chrome:
- Open Google Chrome, click on the Menu (three vertical dots at the top-right corner) and select More tools > Extensions.
- In the newly opened window, you will see all the installed extensions. Uninstall all suspicious extensions related to the unwanted program by clicking Remove.

Clear cache and web data from Chrome:
- Click on Menu and pick Settings.
- Under Privacy and security, select Clear browsing data.
- Select Browsing history, Cookies and other site data, as well as Cached images and files.
- Click Clear data.

Change your homepage:
- Click menu and choose Settings.
- Look for a suspicious site in the On startup section.
- Click on Open a specific or set of pages and click on three dots to find the Remove option.
Reset Google Chrome:
If the previous methods did not help you, reset Google Chrome to eliminate all the unwanted components:
- Click on Menu and select Settings.
- In the Settings, scroll down and click Advanced.
- Scroll down and locate Reset and clean up section.
- Now click Restore settings to their original defaults.
- Confirm with Reset settings.

Step 1: Remove whenwem.online from Edge's notification list
Edge stores its own permission list, separate from Chrome's, and it is often the browser behind these pop-ups on Windows 11 and Windows 10.
Go to Settings > Privacy, search, and services > Site permissions > All permissions > Notifications, or paste
edge://settings/content/notifications. Removewhenwem.onlinefrom Allowed, then add it under Not allowed to send notifications. Notifications that show the Edge logo come from this list.
Edge on Windows 11: Site permissions > All permissions > Notifications. Full procedure with screenshots: Stop website notifications and pop-ups
Instructions for Microsoft Edge
Remove from Microsoft Edge
Delete unwanted extensions from MS Edge:
- Select Menu (three horizontal dots at the top-right of the browser window) and pick Extensions.
- From the list, pick the extension and click on the Gear icon.
- Click Remove.

Clear cookies and other browser data:
- Click on the Menu (three horizontal dots at the top-right of the browser window) and select Settings > Privacy, search, and services..
- Under Clear browsing data, pick Choose what to clear.
- Select Cookies and other site data and Cached images and files. (apart from passwords, although you might want to include Media licenses as well, if applicable) and click on Clear.

Restore new tab and homepage settings:
- Click the menu icon and choose Settings.
- Then find On startup section.
- Click Remove next to any suspicious startup page.
Reset MS Edge if the above steps did not work:
- Press on Ctrl + Shift + Esc to open Task Manager.
- Click on More details arrow at the bottom of the window.
- Select Details tab.
- Now scroll down and locate every entry with Microsoft Edge name in it. Right-click on each of them and select End Task to stop MS Edge from running.

Delete extensions from MS Edge (Chromium):
- Open Edge and click select Settings > Extensions.
- Delete unwanted extensions by clicking Remove.

Clear cache and site data:
- Click on Menu and go to Settings.
- Select Privacy, search and services.
- Under Clear browsing data, pick Choose what to clear.
- Under Time range, pick All time.
- Select Clear now.

Reset Chromium-based MS Edge:
- Click on Menu and select Settings.
- On the left side, pick Reset settings.
- Select Restore settings to their default values.
- Confirm with Reset.
- This will disable extensions and reset startup pages but will not delete bookmarks, saved passwords, or browsing history.

Step 1: Remove whenwem.online from Firefox's notification permissions
In Firefox the permission sits in Settings > Permissions and data > Notifications (in older versions Privacy & Security > Notifications > Settings). Select
whenwem.onlinein the list, click Remove Website, and confirm with Save Changes.Firefox only shows these notifications while it is open, so if they stopped after closing Firefox, this is the browser to clean. The steps are the same on Windows 11 and Windows 10.

Firefox on Windows 11: the Notification Permissions window. Full procedure with screenshots: Stop website notifications and pop-ups
Instructions for Mozilla Firefox
Remove from Mozilla Firefox (FF)
Remove dangerous extensions:
- Open Mozilla Firefox browser and click on the Menu (three horizontal lines at the top-right of the window).
- Select Add-ons.
- In here, select the unwanted extension and click Remove.

Reset the homepage:
- Click three horizontal lines at the top right corner to open the menu.
- Choose Settings.
- Under Home, set your preferred homepage and new tab settings.
Clear cookies and site data:
- Click Menu and pick Settings.
- Go to Privacy & Security section.
- Scroll down to locate Cookies and Site Data.
- Click on Clear Data...
- Select Cookies and Site Data and Temporary cached files and pages, then click Clear.

Reset Mozilla Firefox
If clearing the browser as explained above did not help, reset Mozilla Firefox:
- Open Mozilla Firefox browser and click the Menu.
- Go to Help and then choose Troubleshooting Information.

- Under Give Firefox a tune up section, click on Refresh Firefox...
- Once the pop-up shows up, confirm the action by pressing on Refresh Firefox.

Our tested steps are for Windows 11 and 10. For Safari (Mac), use the instructions below.
Instructions for Safari (Mac)
Delete from Safari
Remove dangerous extensions:
- Open Safari, click Safari in the menu at the top-left of the screen, and select Preferences.
- Go to the Extensions tab, look for any suspicious entries, and click Uninstall to remove them.

Clear history and website data:
- Click Safari in the menu and pick Clear History.
- Set Clear to all history and confirm with Clear History.

Reset Safari:
- Click Safari in the menu and select Preferences > Advanced.
- Enable Show Develop menu in menu bar.
- From the menu bar, click Develop and select Empty Caches.

Then, whichever browser you use
Step 2: Scan the PC if you downloaded anything from the ads
Most people who only saw the notifications can skip this step. If a notification or the page it opened made you download or run a file, delete the file and run a full scan, then a Microsoft Defender Offline scan.
In Windows 11 and Windows 10 open Windows Security > Virus & threat protection > Scan options, select Microsoft Defender Antivirus (offline scan) and click Scan now. The PC restarts and the scan takes about 15 minutes, so save your work first.

Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Choose a proper web browser and improve your safety with a VPN tool
Online spying has got momentum in recent years and people are getting more and more interested in how to protect their privacy online.
One of the basic means to add a layer of security - choose the most private and secure web browser. Although web browsers can't grant full privacy protection and security, some of them are much better at sandboxing, HTTPS upgrading, active content blocking, tracking blocking, phishing protection, and similar privacy-oriented features.
However, if you want true anonymity, we suggest you employ a powerful VPN - it can encrypt all the traffic that comes and goes out of your computer, preventing tracking completely.
Lost your files? Use data recovery software
While some files located on any computer are replaceable or useless, others can be extremely valuable.
Family photos, work documents, school projects - these are types of files that we don't want to lose. Unfortunately, there are many ways how unexpected data loss can occur:
- power cuts
- Blue Screen of Death errors
- hardware failures
- crypto-malware attack
- even accidental deletion
To ensure that all the files remain intact, you should prepare regular data backups. You can choose cloud-based or physical copies you could restore from later in case of a disaster. If your backups were lost as well or you never bothered to prepare any, can be your only hope to retrieve your invaluable files.
Questions about Whenwem.online ads
whenwem.online keeps sending notifications. Is it a virus?
No. Notifications from whenwem.online come from a permission stored in the browser, not from a program installed in Windows. Someone clicked Allow on a prompt from that site, usually without realising what it meant, and the site now sends ads through the browser's notification system.
Antivirus scans often find nothing because there is nothing to find on the disk. Removing whenwem.online from the browser's list of allowed sites stops the messages for good. A scan is still useful if you clicked a notification and downloaded or ran something from the page it opened, because those downloads can be unwanted programs.
Did a notification from whenwem.online infect my computer?
A notification cannot infect a PC. It is a short text with a link that the browser displays. Clicking it opens a page, and a page cannot install anything unless you agree to a download and run the file.
So the answer depends on what you did after clicking. Looked and closed: you are fine. Downloaded but did not open: delete the file.
Opened a downloaded file: uninstall what it added and scan the PC. Typed card or login details: contact the bank and change the password. In every case, remove whenwem.online from the browser's allowed notifications so the messages stop.
What is Whenwem.online?
Whenwem.online is a push-notification spam site, a kind of adware. It earns money by showing desktop notifications, and each view, click or redirect pays whoever runs it. It is not something people usually choose; it arrives through a free download, a fake button or a misleading prompt.
Whenwem.online does not encrypt files or take control of Windows, but its ads are sold to anyone, including scam operators, so they can lead to fake virus warnings and unwanted downloads. The steps in this guide remove it from Windows and from each browser.
Why does whenwem.online keep showing up?
There are two possible reasons. If it appears as desktop notifications, a browser on this PC was given permission to receive them from whenwem.online, usually through a misleading prompt. That permission stays until you remove it in the browser's site settings.
If it appears as tabs or redirects, an ad on a site you visit is opening it, or an extension or program on the PC is. Test a private window: if whenwem.online never appears there, an extension is the likely cause. The plan above covers each case.
Do I have to change settings in every browser?
Only in the browsers that allowed whenwem.online, but checking all of them takes a minute and is worth it. We saw the notifications in Chrome, Edge and Firefox. Chrome and Edge keep their notification lists under site settings, and Firefox under Privacy & Security > Permissions.
Remove whenwem.online and any other unfamiliar site from each list, then turn off new notification requests if you do not need them. Remember that every browser profile has its own list, so a second profile can keep the messages coming after you clean the first.
Are the pop-ups I see really from Whenwem.online?
Compare them with the details in the table above. Whenwem.online produces desktop notifications, and the clearest sign of it is notifications from whenwem.online. Other adware looks similar, so check the name of the sending site at the bottom of a notification, the address in the tab that opened, or the newest entries on the extensions page.
If those match, this guide fits. If you see a different name, the same kind of steps apply, but remove the item you actually find rather than guessing.
Is it safe to click Block or Allow on a notification prompt?
Clicking Block is safe; it only tells the browser not to show notifications from that site. Clicking Allow is not dangerous to your files either, but it gives the site a channel to your desktop that spam sites abuse at once.
The prompt itself is part of the browser, so you can trust its buttons. What you cannot trust is the text on the page around it. If a page explains why you must click Allow, choose Block or close the tab.
My scan found nothing, but the ads continue. Why?
Because the source may not be a file a scanner looks for. Browser notifications are a permission stored in the browser, and many adware extensions are not flagged because they come from an official store.
Some ad-supported programs are only reported if you enable detection of potentially unwanted apps. So a clean scan does not mean the job is done. Check each browser's notification permissions and extension list by hand, and turn on Potentially unwanted app blocking in Windows Security before scanning again.
I let a "support technician" from an ad connect to my PC. What should I do?
Act quickly but calmly. Disconnect the PC from the internet first, so the connection ends. Uninstall the remote access tool they asked you to install and check Installed apps for anything else added during the call.
Run a Microsoft Defender full scan and offline scan. From another device, change your e-mail and banking passwords and sign out of all sessions.
If you paid by card, bank transfer or gift card, contact your bank or the card issuer immediately, and report the scam to the police. Do not answer if they call back.
Will Fortect remove Whenwem.online?
No program removes Whenwem.online itself, because there is nothing on the PC to remove: the notifications come through a permission saved in the browser, and only the browser's settings take it away, as the steps above show.
What Fortect can do is check the rest of Windows. Its free scan looks for malware, unwanted programs and damaged system files, which is useful if you clicked the ads, downloaded something from the pages they opened, or are not sure what else changed on the PC.
If the scan finds nothing and the notifications stopped after you removed the permission, this problem is solved. Use Microsoft Defender as a second opinion whenever you have downloaded files from pages like these.
Sources
- Wikipedia: Get-rich-quick scheme (read October 6, 2026)
- Google Chrome Help: Use notifications to get alerts (no longer online) (read October 6, 2026)
- FTC: How to recognize, remove and avoid malware (read October 6, 2026)
- Microsoft Learn: Microsoft Defender Offline (read October 6, 2026)
- Microsoft Learn: How Microsoft names malware (read October 6, 2026)