Online threat detection - repeated warnings

Good morning,

I am getting sporadic messages saying "Suspicious connection blocked. Chrome.exe tried to establish a connection to xxxxxxx using an expired certificate." The specific sites vary, but are not ones I am trying to access. e.g., measureadv.com, rybbit.openrussian.org… This behavior happens on all three laptops (Windows 11) on the network. Two of the laptops have the same chrome profile, the third has a different chrome profile. I reinstalled Windows from a USB drive on one laptop but the problem persists. Any suggestions please?

Find more posts tagged with

website blocked

blocked threats

Accepted answers

All comments

AlFifi_Defender

Hi @COLINR ,

Thanks for bringing this up – you’re definitely not alone in encountering these warnings.

The recurring message:

“Suspicious connection blocked: Chrome.exe attempted to access a site using an expired certificate”

suggests that either your Chrome profile or a third-party extension or ****** is trying to auto-load background connections to suspicious domains.

🛠️ Here’s a full troubleshooting workflow I’d recommend:

✅ Step 1: Confirm Extensions Are Safe

Go to chrome://extensions/ and disable all extensions, then re-enable them one by one.Look out especially for unknown or recently added ones.

✅ Step 2: Clear Chrome Network Cache

Sometimes expired TLS certs linger in Chrome cache.

Run this in Chrome:• Open this URL: chrome://net-internals/#dns• Click Clear host cache

Then visit: chrome://net-internals/#sockets• Click Flush socket pools

✅ Step 3: Run a Deep System Scan

Use Bitdefender’s Rescue Environment:

• Open Bitdefender → Protection → Rescue Environment• Let it reboot and perform a deep offline scan

This can detect rootkits or stealth malware possibly hijacking Chrome.

✅ Step 4: Monitor Active Connections

Use Netstat or GlassWire (free version) to view what connections Chrome is making in real-time.

It helps isolate if a background app or injected ****** is initiating these outbound calls.

✅ Step 5: Router Check

If all 3 devices on the same network are affected, your router firmware may be compromised or DNS is hijacked.

Try:

• Reset router to factory settings• Set DNS manually to 1.1.1.1 (Cloudflare) or 8.8.8.8 (Google DNS)• Upgrade router firmware if possible

Let me know if this helped — and I’ll be happy to walk you through advanced checks if needed.

Together we shield smarter.– AlFifi_Defender 🇸🇦Bitdefender Community Member

daler

Also getting "Suspicious connection blocked" many times over a day, but only to meisureadv.com . Went to Bitdefender…Protection… but found no "Rescue Environment" listed. My laptop is not a chrome device, but a windows 11 device, thus a Windows Bitdefender Total Security application. Is the "Rescue Environment" not available in the Windows Total Security protection heading? Will attempt to place this website domain in the anti-spam "Manage spammers" list and see if that suppresses the "suspicious connection blocked" notification for this site.

COLINR

Thank you! Will check those steps and get back. However, I have already run a full BD scan (not in the rescue environment though) and a Norton Power eraser scan (with check for rootkits) to no avail. The extensions are all legit (just three: BD, Google docs and Google Drive) and the DNS in the router looks fine (already set to 8.8.8.8).

AlFifi_Defender

Hi @daler ,

Thanks for sharing your experience — it’s great to see more users reporting detailed cases like this.

✔️ The Rescue Environment should be available in Bitdefender Total Security on Windows 11, but it might not show up if:

It hasn’t been installed manually before, or
Secure Boot is enabled in UEFI BIOS (which sometimes blocks loading it).

If you’d like, I can guide you on checking that.

⚠️ Also, adding a domain to “Manage Spammers” may not affect network-level blocks.

Instead, try this path:

Protection > Online Threat Prevention > Manage Exceptions

or go through Firewall > Rules to isolate Chrome or background services triggering it.

Let me know if you’d like help walking through these steps!

— AlFifi_Defender 🇸🇦

Together we shield smarter

COLINR

Message removed…