Ad redirects

[Shadowdrake]

Others are still having the issue: I've seen at least 2 people on dc discord servers mention malicious ad redirects/popups today.

[angelicdragonpuppy]

Affecting me too.

[RealWilliamShakespeare]

Yeah, I've been completely unable to use the site on mobile recently because every SINGLE time this happens:

 

(Sorry for massive pic - had to transfer the screenshot onto the laptop)

 

Would it not be possible for TJ to just... Not allow these super annoying and downright nasty malware ads on the site? Can popups be disallowed? (This query might be better suited for the Suggestions section but I don't want to be annoying lol)

 

Edited August 11, 2019 by RealWilliamShakespeare

[Fuzzbucket]

Can you right click it to get the address and then specifically block it ?

 

But it is malware on your machine:

 

https://techzillo.com/congratulations-youve-won/ 

https://malwaretips.com/blogs/remove-congratulations-you-won/ 

 

Scroll down for how to remove it.

[Shadowdrake]

@Fuzzbucket It could be malware, but it almost certainly isn't. Ads are more than just simple images and can easily hijack your browser without needing to install viruses that would be caught by already-installed antiviruses. The fact that it's happening to multiple unrelated people all at the same time suggests it's a bad ad making its rounds again.

 

https://www.wired.com/story/pop-up-mobile-ads-surge-as-sites-scramble-to-stop-them/

https://www.howtogeek.com/364944/why-do-websites-redirect-to-fake-“congratulations”-gift-card-pages/

 

As the articles state, even trustworthy sites like The New York Times can be victim to them if the advertising system has had them sneak through, and they're a browser-based problem, not a malware problem.

Edited August 11, 2019 by Shadowdrake

[Fuzzbucket]

Sure - but once they land, they need rooting out. They can COME from a bad ad, but then they need the process to remove them.

 

Everyone I know who ran a malware sweep after spotting them was free for at least a while. Malwarebytes and adwcleaner, both.

[TJ09]

In order to do anything, I'm going to need a screenshot of the ad that appears on the page when this happens. Note that the forums have two ad locations (above and below the content) and it could be either.

 

I can block certain ads from appearing but I need to know what ad it is.

 

1 hour ago, Fuzzbucket said:

Sure - but once they land, they need rooting out. They can COME from a bad ad, but then they need the process to remove them.

This is not necessarily true. It's very likely just a specific ad that, once blocked, will solve the issue.

[Bloommist]

Hope this helps

[Fuzzbucket]

It's from mklpserver.com

 

https://www.corvetteforum.com/forums/help-forum/4307572-redirect-pop-up-adds-back.html if it helps.

Edited August 11, 2019 by Fuzzbucket

[Naraku]

Newer version of Chrome on mobile/tablet has the ability to block redirects by default. I blocked this address on my smartphone yesterday, never got the redirect again. I tested this on my old tablet, with old Chrome-- the redirecting ad immediately popped up. The screenshot Bloommist and fuzz provided has the same link as this screenshot does, so it's probably just one problematic ad.

 

Edited August 11, 2019 by Naraku

[TJ09]

39 minutes ago, Bloommist said:

Hope this helps
 

By that point you've already been redirected; I need to see the ad that shows up on site unfortunately.

 

29 minutes ago, Fuzzbucket said:

It's from mklpserver.com 

 

https://www.corvetteforum.com/forums/help-forum/4307572-redirect-pop-up-adds-back.html if it helps.

There are no google ads from that domain. I doubt that's the URL they put into the ad, since that makes it too easy to find.

 

20 minutes ago, Naraku said:

Newer version of Chrome on mobile/tablet has the ability to block redirects by default. I blocked this address on my smartphone yesterday, never got the redirect again. I tested this on my old tablet, with old Chrome-- the redirecting ad immediately popped up. The screenshot Bloommist and fuzz provided has the same link as this screenshot does, so it's probably just one problematic ad.

Catching the ad when chrome blocks the redirect is exactly what I need, not the page *after* the redirect.

[Fuzzbucket]

I've blocked mkplserver anyway - though I have never actually got the thing.

[Fuzzbucket]

Apparently there are many ads that do this... (reading help treads on other forums where people are affected.)

Edited August 11, 2019 by Fuzzbucket

[Naraku]

Found the link (in spoiler for its length), is this the link you're looking for, TJ?

 

Spoiler

https://adclick.g.doubleclick.net/pcs/click?xai=AKAOjsu1v21BGVeInpuAP3YsuePCZhmGgcz2rHCpu-sLkdMdpndNceHBgkv6G5HagQWylxkpzNVf2K15kVUvDWDoZKYGxMZnhO3l5zXHDZ2ZJANUw-gdArRY0Ln4ROu5X-Rmegoo38Qtp9ElMVIrc8beeEk5VqdrGdoVd5XUqaPpErglUH34YQSFSsgv6f8S0aJy5GB2xyHE_IHUcp2VITxpq9NbuVieyhvX8QvuJjNavmZdtoG01GpWKpUKIjpun7bgrMkh9zLUJDro_ip5mhubUx2ZcRa0Uo49qlwQ6GgzDcYVLctjYZRiphfZ3uYXLkUoVh6ldXdCpchzLxB1lU_yi0UOIc_MZbesac8qc50HxPqNI8QEeBz7IEoQutmkCxEr4reQcIPh-La7lgrtKDAact6OYGm2ZLkLwnW8iMRkMK2yosFvwU5g6eBQaNw5Dmo5esBbvJPN3TQ84xYO0SoqEBjMf95Kq5gx38rIZxGZ60X7Isls65nx0MJ8aNZK8hrFerSnIhZIBvzoqii07zyBlWXin65olCfwTAubjbqh5BTIuiJ_KRsv9zRdtQ0NubV67BpLdpf20CTirXSdkmYjw5-9vkMoHmyydMOzqr_M7QwaIy7J2OP9ex8llDBz37E7dbqLJ3nxTXrU1HI4zViM_Z663_jw7t3ZmUMmjo2sDVBLeKZeY-7UF1FD4PIMet9_vNQEfVOcToIi4p7Hz_JNZmXyHOEHlzSsk2LIytXCM07vbicjnenYtvJFEtETReow6SDMkwByugPSRBFyU_hrMowkPMSHfYzJPhjTMjiWPSY4Ufqxzb45GBGca5z0nhrDTrvCRlM0CTSypA0x6UpTfsdt5fNCQgeFRwNt-wygTPzoVvoA-kgcScQ_ZP1yyW73iabcDkWxtACjHGgNSNABn3TLHIu9t0MBtpFMsr-UJSendwtM6XfsGEHHF4w5ciGzqXr_GZTIeD02-M-UPNGel9aCz2c4RqP4ut9sWcUS8dFpykckSgnRaVpnWektOmIDQwW8N8k7EGNHndSFPm1Wt2HiJAYScFE12cLaTzV24LQEQTjL2HpyotCEAkUbdMPt9mN4L7SKGFQS6gIWOztTSGCE&sai=AMfl-YSGCTzIctEFZQkOEJBrXTH7fFpHJ-lRLtFhoyOE3AuB4sJA1VSldVNpuCfw84-nI3DqFpTrlfcmtLqjO0xbknzNn-2LFAeyerx2Sol-9aiNeCz6t9JCzUAFMwplS-lX6ZP9c-fEkIOTOQ-RalviRmLpknooplNM-m3qPhQsQuVRAIw&sig=Cg0ArKJSzH_dhaaPZd49&urlfix=1&adurl=https://www.nike.com/ 

 

[TJ09]

8 minutes ago, Naraku said:

Found the link (in spoiler for its length), is this the link you're looking for, TJ?

 

  Hide contents

https://adclick.g.doubleclick.net/pcs/click?xai=AKAOjsu1v21BGVeInpuAP3YsuePCZhmGgcz2rHCpu-sLkdMdpndNceHBgkv6G5HagQWylxkpzNVf2K15kVUvDWDoZKYGxMZnhO3l5zXHDZ2ZJANUw-gdArRY0Ln4ROu5X-Rmegoo38Qtp9ElMVIrc8beeEk5VqdrGdoVd5XUqaPpErglUH34YQSFSsgv6f8S0aJy5GB2xyHE_IHUcp2VITxpq9NbuVieyhvX8QvuJjNavmZdtoG01GpWKpUKIjpun7bgrMkh9zLUJDro_ip5mhubUx2ZcRa0Uo49qlwQ6GgzDcYVLctjYZRiphfZ3uYXLkUoVh6ldXdCpchzLxB1lU_yi0UOIc_MZbesac8qc50HxPqNI8QEeBz7IEoQutmkCxEr4reQcIPh-La7lgrtKDAact6OYGm2ZLkLwnW8iMRkMK2yosFvwU5g6eBQaNw5Dmo5esBbvJPN3TQ84xYO0SoqEBjMf95Kq5gx38rIZxGZ60X7Isls65nx0MJ8aNZK8hrFerSnIhZIBvzoqii07zyBlWXin65olCfwTAubjbqh5BTIuiJ_KRsv9zRdtQ0NubV67BpLdpf20CTirXSdkmYjw5-9vkMoHmyydMOzqr_M7QwaIy7J2OP9ex8llDBz37E7dbqLJ3nxTXrU1HI4zViM_Z663_jw7t3ZmUMmjo2sDVBLeKZeY-7UF1FD4PIMet9_vNQEfVOcToIi4p7Hz_JNZmXyHOEHlzSsk2LIytXCM07vbicjnenYtvJFEtETReow6SDMkwByugPSRBFyU_hrMowkPMSHfYzJPhjTMjiWPSY4Ufqxzb45GBGca5z0nhrDTrvCRlM0CTSypA0x6UpTfsdt5fNCQgeFRwNt-wygTPzoVvoA-kgcScQ_ZP1yyW73iabcDkWxtACjHGgNSNABn3TLHIu9t0MBtpFMsr-UJSendwtM6XfsGEHHF4w5ciGzqXr_GZTIeD02-M-UPNGel9aCz2c4RqP4ut9sWcUS8dFpykckSgnRaVpnWektOmIDQwW8N8k7EGNHndSFPm1Wt2HiJAYScFE12cLaTzV24LQEQTjL2HpyotCEAkUbdMPt9mN4L7SKGFQS6gIWOztTSGCE&sai=AMfl-YSGCTzIctEFZQkOEJBrXTH7fFpHJ-lRLtFhoyOE3AuB4sJA1VSldVNpuCfw84-nI3DqFpTrlfcmtLqjO0xbknzNn-2LFAeyerx2Sol-9aiNeCz6t9JCzUAFMwplS-lX6ZP9c-fEkIOTOQ-RalviRmLpknooplNM-m3qPhQsQuVRAIw&sig=Cg0ArKJSzH_dhaaPZd49&urlfix=1&adurl=https://www.nike.com/  

 

Are you sure that's specifically from an ad where Chrome says "blocked redirect"? It's just a link to Nike. I took a look at ads that link there and

 

If it was on the forums, did you check both the header and footer ads?

 

Regardless, a screenshot is preferred.

[Naraku]

Yep, it is the Nike ad that's causing the redirect: 

 

[RealWilliamShakespeare]

20 hours ago, TJ09 said:

In order to do anything, I'm going to need a screenshot of the ad that appears on the page when this happens. Note that the forums have two ad locations (above and below the content) and it could be either.

 

Below is the way the ad pops up on my mobile for the forum - as you can see, behind the popup is a different, unrelated ad, so I'd say it would be the one below the content.

 

 

On 8/11/2019 at 1:18 PM, RealWilliamShakespeare said:

Yeah, I've been completely unable to use the site on mobile recently because every SINGLE time this happens:

 

 

[missy_]

I spoke too soon in the other thread (now closed), as it happened to me again, as well. 

 

I was doing a bit of testing before commenting further. 

 

On my iPhone 8 Plus running 12.3.2, I received a redirect. 

 

Upon downloading the newest iOS version, 12.4, I did not receive further redirects. 

 

iOS 12.4 has a number of important security flaw fixes: https://support.apple.com/en-us/HT210346 

 

Since installing it, and testing it without blocking any URLs or ads, I have not encountered any redirects. Fingers crossed. 

 

 

Edited August 13, 2019 by missy_