Potential malicious advertisements

[sanunes]

Forum URL: bsn.boards.net/

Hello,



Over the weekend (Nov 6th and 7th) when visiting ProBoards I had strange behavior in my browser. My page would load a link that would be asking for me to click to continue when loading the page from either a page refresh, moving to a new thread, or clicking the post button. Twice the new page claimed to be from McAfee and with that I closed my browser and did an AV check with my local software with a negative result. I have temporarily enabled my script blocker to see if it stops these pages since this was only happening on the ProBoards I visit.


The most recent links I saw in my address bar one had the domain of "fast-travel" with the header of "Click to Allow" and the other was from the domain "scan-virus" which claimed to be McAfee Total Security.

[yogibearbull]

I also got an intrusive McAfee solicitation from a PB forum (11/7/21, around 10:00pm Central). I didn't see it in the top or bottom ad panels but it just cropped up. I got back to the PB page using the back-arrow several times, ran Windows security just in case.

[Craig]

Hi

If possible, if you see this again, would you be able to take a screenshot and post it here. They can hopefully use that to track down the ad and remove it.

Craig

[sanunes]

Here is the last one I got from the Virus website.  I forgot to include it with my first post.

Attachments:

[Craig]

Nov 8, 2021 4:41:11 GMT -8 sanunes said:

Here is the last one I got from the Virus website.  I forgot to include it with my first post.

Thanks

Staff are online a little later today anfd will hopefully be able to quickly identify it.  if they do have further questions, could i ask you to check back from around 16:00gmt for a response.

[Michael]

Hi,

Thank you for the report. We should hopefully be able to block this soon.

[Michael]

If anyone who has seen this ad could provide any of the following information, it will help us track down this bad ad quicker!

• Time when it happened (with timezone)
  
• Device/browser used when receiving the ad (so far this appears to be a desktop ad on Windows)
• The URL where you received the redirect (thread link, homepage, or otherwise)
• The URL you were redirected to
  

If you don't feel comfortable sharing this information publicly, please feel free to PM me.