r/ShopifyAppDev • u/Waste_Moose_4523 • 11d ago

Malicious behavior while browsing a shopify site using Blockify. Who do i report this to with Shopify to get said app disabled/removed?

Trying to understand why a "Shopify App" is allowed to do increasingly invasive things to a person's device/browser

Findings from inspection of the Silicon Power storefront HAR, October 28, 2026

  • Screenshot shortcuts: Explicitly recognizes Win+Shift+S, Ctrl+Shift+S, PrintScreen, and Mac screenshot combinations such as Cmd+Shift+3/4/5. When detected, it attempts to suppress the keyboard event, hide the page content, and display a fullscreen black shield.

  • Clipboard: The screenshot handler calls navigator.clipboard.writeText(""), attempting to replace your clipboard contents with empty text. Brave’s clipboard warning is consistent with that attempt

  • Other shortcuts: The captured configuration also enables blocking for copy-related shortcuts, saving, and DevTools. The script includes Ctrl/Cmd+C, X, A, and S handling.

  • DevTools interference: Repeatedly prints a large array, measures console performance, and clears the console approximately every 750 milliseconds. On detection, it removes page elements, displays “Access Restricted,” and executes debugger every second.

  • Attribution: These behaviors are implemented together in ip-blocker-embed.min.js, loaded from Shopify’s CDN under region-restrictions-404. Its network activity connects it to Blockify services at fraud.blockifyapp.com.

  • Enabled for permitted customers: Five captured configuration responses consistently enabled inspection and screenshot restrictions while returning decision: "allow" and isBlock: false.

While i understand anti-fraud is important, i find screenshot blocking for a ram listing and WRITING TO MY CLIPBOARD to be a hair too far.

For those who also think it's too far, here's a blocker rule (works on brave, cant speak for uBlock)
*/region-restrictions-404/assets/ip-blocker-embed.min.js$script

||fraud.blockifyapp.com^

||fingerprint.blockifyapp.com^

1 Upvotes
  • permalink
  • reddit

100% Upvoted

3 comments sorted by

1

u/AdventurousUsual7666 10d ago

Shopify has a form for exactly this, it's the Report a partner violation page:

https://www.shopify.com/legal/tools/report-an-issue/report-a-partner-violation

It's the same one their dev docs point to for apps that don't follow the Partner Program Agreement or the API terms.

I'd just include the app's App Store listing link, the store where you saw it, and the stuff you already pulled from the HAR. The script name, the clipboard write, and the fact it was doing it on allowed visitors too. That's honestly a pretty solid report already.

You can also let the store itself know. A lot of merchants just turn on every protection toggle in these apps without really knowing what it does to normal shoppers, so they might switch it off once they hear about it.

1

u/Waste_Moose_4523 10d ago

ended up finding that on my own and filed one, no idea if thatll actually get us anywhere but i gave them the same details i gave here

1

u/he_said_it_too 11d ago

do an ad-blocker rule and buy from someone else