Bad Redirect Ad

[Michael]

Jul 11, 2019 10:26:06 GMT -8 becca2000 said:

Most of our users aren't especially tech-savvy. Asking them that question is going to elicit a lot of "how would I know?" answers. On the other hand, the default on Safari on the iPhone, which it seems most are using, is to accept cookies. So I feel like it's unlikely most would be able to change that setting and thus they probably are set up to accept cookies.

Could you inquire with them how long it takes before they're redirected? Is it immediate or does it take 15-30 seconds on the page before they're redirected?

I've busted out the office testing devices and am attempting to locate this manually.

[becca2000]

Thanks, Michael. I just asked and will be back later today to report back.

[GlytchMeister]

For what it’s worth, I’m still getting redirects, and they don’t let me “go back.” It locks up the tab with a dialogue box saying my iPhone has been compromised and asking for “ok” or “cancel”, and I have to close the tab.

[Michael]

Jul 12, 2019 16:02:30 GMT -8 GlytchMeister said:

For what it’s worth, I’m still getting redirects, and they don’t let me “go back.” It locks up the tab with a dialogue box saying my iPhone has been compromised and asking for “ok” or “cancel”, and I have to close the tab.

Hi,

"Still" as in how long ago? More updates went into place roughly an hour ago that should have resolved the issue.

[becca2000]

I have someone saying they got it 20 minutes ago. I'm sorry I haven't answered your question but I can't get any of my members to answer it. They don't understand the question or they give differing answers. All they can agree on is that they keep getting it and it requires closing the browser and starting again.

[adminabp]

Jul 12, 2019 16:28:22 GMT -8 becca2000 said:

I have someone saying they got it 20 minutes ago. I'm sorry I haven't answered your question but I can't get any of my members to answer it. They don't understand the question or they give differing answers. All they can agree on is that they keep getting it and it requires closing the browser and starting again.

It may not be just an issue with what is currently on the website but something that is lingering on their phones.

Two articles that MAY be of help:

Remove “Your iPhone has been compromised” Pop up “Virus” Message (July 2019 Update)

Your iPhone has been compromised, (and how it really hasn’t)

[Michael]

Jul 12, 2019 16:58:02 GMT -8 adminabp said:

Jul 12, 2019 16:28:22 GMT -8 becca2000 said:

I have someone saying they got it 20 minutes ago. I'm sorry I haven't answered your question but I can't get any of my members to answer it. They don't understand the question or they give differing answers. All they can agree on is that they keep getting it and it requires closing the browser and starting again.

It may not be just an issue with what is currently on the website but something that is lingering on their phones.

Two articles that MAY be of help:

Remove “Your iPhone has been compromised” Pop up “Virus” Message (July 2019 Update)

Your iPhone has been compromised, (and how it really hasn’t)

This is good advice and I'm slightly disappointed that I didn't think of this before.

Myself and VS Admin have been working on this for the last couple of days and we're both super stumped at this point. Nowadays we've been pretty fast at getting bad ads blocked quickly, especially when it seems to be limited to just iPhones (or just android or just a specific browser/device which narrows our search dramatically).

[becca2000]

I appreciate all your efforts! I will pass along those articles and hopefully that will help, thanks.

[GlytchMeister]

Jul 12, 2019 16:18:26 GMT -8 Michael said:

Jul 12, 2019 16:02:30 GMT -8 GlytchMeister said:

For what it’s worth, I’m still getting redirects, and they don’t let me “go back.” It locks up the tab with a dialogue box saying my iPhone has been compromised and asking for “ok” or “cancel”, and I have to close the tab.

Hi,

"Still" as in how long ago? More updates went into place roughly an hour ago that should have resolved the issue.

As of when I wrote the above message, mere minutes. Will try to nuke safari, as inconvenient as it may be.

[nero1]

Jul 11, 2019 11:43:53 GMT -8 Michael said:

Could you inquire with them how long it takes before they're redirected? Is it immediate or does it take 15-30 seconds on the page before they're redirected?

I've busted out the office testing devices and am attempting to locate this manually.

Hi, I've asked around and one of the moderators who first mentioned the redirects answered:

And yes it takes a bit for it to happen it’s never right away. Also it’s a redirect, first thing it does is leave TBN.

We've been talking about this since he first mentioned it (Jul 10, 2019), if you need more answers, I'll ask him.

------

I never had a redirect myself, but just a couple of hours ago, when I hovered (not clicked) a ad banner I got a redirect too (pc: win10, browser: edge).

It was a banner from proximus (my isp) 
the redirect:
eu.moneysavingexpertquickhousesale.icu/6f798c571036e8563572d1d5bf8373a2/index.html?ip=2a02%3Aa03f%3A56d3%3A3e00%3A3c8a%3A7e56%3Aeb1b%3A9cde&siteid=YjY0MTA3MzIxOTUxMzEwNjY2NjI2IzE1NjMwMTA0NDhANDkwN0BfZWE5YzA5NmJmM2MxOTUzNWRmMTVmOWE2MzVkZmZhMDk&trackid=201907130934161762

I already contacted proximus, to ask for an explanation: they claim it's a scam, not their banner nor ad.

The last couple of hours the ad's at the bottom have been replaced by these proboard (safe) ad's:

[markanite]

10000islands.proboards.com/

My forum above is also getting a lot of redirect ads, on desktop and on mobile devices. It appears to be redirecting to 'Wheel spin' websites. I will liaise with our members in regards to frequency and duration before redirect.

Any tips on what we can do in the mean time?

[GlytchMeister]

Ok I nuked my browser (“clear history and website data” for iPhone safari) and I haven’t gotten it again so far.

[komiharu]

My forum is also still getting these redirecting ads, and like everyone else says, it appears to be only iPhone users. It appears that the majority of them are the VPN ones posted in the OP. The ads take about 10 seconds to redirect the user, & the affected users have cookies enabled on the affected browser.

Current plan of action on my end is to tell them to disable cookies, & clear their history / website data like the above poster said, and I'll reply back if that works for us too. 

[GlytchMeister]

Jul 13, 2019 15:11:22 GMT -8 komiharu said:

My forum is also still getting these redirecting ads, and like everyone else says, it appears to be only iPhone users. It appears that the majority of them are the VPN ones posted in the OP. The ads take about 10 seconds to redirect the user, & the affected users have cookies enabled on the affected browser.

Current plan of action on my end is to tell them to disable cookies, & clear their history / website data like the above poster said, and I'll reply back if that works for us too. 

Just got this one after having nuked my browser as above. So it didn’t work.

This one is instant and it fills my “back” button backlog with copies of itself somehow so I can’t back out.

[Michael]

Hi,

We blocked even more things over the weekend (on the 13th). Did anyone experience any issues on the 14th or today?