Ads redirecting android phones to malicious sites

[Hail The Brain Slug]

Starting yesterday, I noticed frequently when I browse to the forums here on my android phone I get redirected to a malicious site setup to imitate an official Google site, popping up a scare-tactics notification.

I think it must be the ads.

THE FOLLOWING LINKS ARE TO MALICIOUS SITES, DO NOT CLICK. I AM POSTING FOR THE RECORD.

I get sent here

http://us.unidingcom.com/sadd/redirect.html?model=G5&brand=LG&osversion=Android 7.0&ip=xx.xx.xx.xx&voluumdata=BASE64dmlkLi4wMDAwMDAwMi0zZmFkLTQ2ZDktODAwMC0wMDAwMDAwMDAwMDBfX3ZwaWQuLjkxNTk5MDAwLWYzYTgtMTFlNi04OTRkLTEyOTk2ZmIzNTEzMl9fY2FpZC4uNjdkYjU4MmMtZDk5MS00YmUyLWI3NjMtNWQzYmNhNmNjOGViX19ydC4uUl9fbGlkLi41ODI2MjUzZC03YzM4LTRhNGMtYmExMi04MTcyYjViMmYyNjZfX29pZDEuLmUyYjU5OWY5LWU2MzQtNGJmYy04NjRmLTlhZDY2YzcxMDkwNV9fdmFyMS4uMTU1NjVfX3ZhcjIuLjBfX3JkLi5fX2FpZC4uX19hYi4uX19zaWQuLg&PREFIJO=15565&PUBID=0&clickid=1487184012mb37205151253

Which redirects to here

http://us.cqbaoshanc.pw/sadd/0_index0.php?model=G5&brand=LG&osversion=Android 7.0&ip=xx.xx.xx.xx&voluumdata=BASE64dmlkLi4wMDAwMDAwMi0zZmFkLTQ2ZDktODAwMC0wMDAwMDAwMDAwMDBfX3ZwaWQuLjkxNTk5MDAwLWYzYTgtMTFlNi04OTRkLTEyOTk2ZmIzNTEzMl9fY2FpZC4uNjdkYjU4MmMtZDk5MS00YmUyLWI3NjMtNWQzYmNhNmNjOGViX19ydC4uUl9fbGlkLi41ODI2MjUzZC03YzM4LTRhNGMtYmExMi04MTcyYjViMmYyNjZfX29pZDEuLmUyYjU5OWY5LWU2MzQtNGJmYy04NjRmLTlhZDY2YzcxMDkwNV9fdmFyMS4uMTU1NjVfX3ZhcjIuLjBfX3JkLi5fX2FpZC4uX19hYi4uX19zaWQuLg&PREFIJO=15565&PUBID=0&clickid=1487184012mb37205151253

Unfortunately I do not know which ad is doing the redirect since it occurs during the forum page loading.

 

[lupi]

Yes, occurred around same time I noticed those new bottom of screen pop ups ads when I posted yesterday about these. Still hasn't seen a response though.

 

[master_shake_]

ads. pffft!

firefox plus adblock even on android.

if sites have problems with ads they are putting on their site then i have to control what ads (none) i want to see.

 

[jsimenhoff]

Thanks for reporting this. I'm forwarding this along to our Ad Management team.

 

[lupi]

Just had it occur again.

 

[jsimenhoff]

A fix was supposed to be implemented today, at 9am EST. Our Ad Operations team is reaching out to our partners on this matter. Sorry for the inconvenience.

 

[CrackRabbit]

I'm having similar issues in iOS, getting a redirect to a cloudatt.com address when using chrome. Next time it happens I'll see if I can grab a link.

 

[lupi]

Another day, another occurence.

 

[jsimenhoff]

I'm sorry you're still having these issues. I'll ping the Ad Team again.

 

[Hail The Brain Slug]

I just got hijacked again, too.

 

[fralexandr]

Still happening... i got redirected to ailmenes.info

 

[Hail The Brain Slug]

I started getting hijacked from ads on the main Anandtech page now, as well. This is NOT okay.

I don't want to have to stop coming here, but I'm seriously considering it. The obscene amount of ads after Purch took over was enough. Somebody needs to take control of this circus or it won't end well for Anandtech.

You might try and pass the blame on to the ad team, or the company supplying the ads but any reasonable website would literally pull all the ads in a situation like this until it can be sorted. The behavior you've displayed about this issue is not acceptible.

 

[CrackRabbit]

I started getting hijacked from ads on the main Anandtech page now, as well. This is NOT okay.

I don't want to have to stop coming here, but I'm seriously considering it. The obscene amount of ads after Purch took over was enough. Somebody needs to take control of this circus or it won't end well for Anandtech.

You might try and pass the blame on to the ad team, or the company supplying the ads but any reasonable website would literally pull all the ads in a situation like this until it can be sorted. The behavior you've displayed about this issue is not acceptible.

No kidding, I was redirected to a porn/escort site this morning. The Adblock will be going on and not turned off because of this.

 

[Crono]

This is why I use uBlock Origin on desktop and AdAway on Android.

 

[lupi]

Still occuring.

 

[jsimenhoff]

Our Ad team will need more information from each of you to remove you from this Ad service. Look out for my PM!

 

[Tim]

I also got a redirect to a malicious site this morning on my Android phone.

 

[Hail The Brain Slug]

Our Ad team will need more information from each of you to remove you from this Ad service. Look out for my PM!

Are you serious? You need to remove this ad service altogether, it's very likely hitting anyone that visits Anandtech.com or forums.anandtech.com

 

[Pulsar]

Our Ad team will need more information from each of you to remove you from this Ad service. Look out for my PM!

Tell me you are kidding. Remove us from the ad service?

 

[jsimenhoff]

Tell me you are kidding. Remove us from the ad service?

Perhaps there is a misunderstanding? I am trying to blacklist your names from this service since other efforts did not resolve this issue. Are you also redirected to malicious content?

 

[Hail The Brain Slug]

Perhaps there is a misunderstanding? I am trying to blacklist your names from this service since other efforts did not resolve this issue. Are you also redirected to malicious content?

That's exactly what our understanding is. Instead of trying to SOLVE THE PROBLEM you want to just block the complaining users from the ad service so they will stop complaining.

I'm going to file a complaint with Purch about how this is being handled.

 

[Pulsar]

Perhaps there is a misunderstanding? I am trying to blacklist your names from this service since other efforts did not resolve this issue. Are you also redirected to malicious content?

There is no misunderstanding. I used a Samsung Galaxy S7 and Chrome. I also use the built-in Internet browser. Every person using this combination has certainly been seeing these. Many probably don't realize what's going on. Blocking the users who complain isn't addressing the issue at all. It's a clear sign that the money you are receiving in advertising dollars is far more important that the security of your users. The CORRECT method of dealing with it is to shut down the ads from the offending company until such time as they claim to have fixed the issue. Malicious content isn't a joke.

I can't believe any corporation in this day and age believes it's an acceptable solution to serving malicious content.

 

[jsimenhoff]

You are all 100% correct. I misspoke. I'm terribly sorry for this misunderstanding. We are collecting information not to remove you from these ad services but to kill the ads themselves. If any of you can answer my PMs it will help in figuring where these ads are coming from and how they are targeting you.

 

[Fardringle]

There are problems with some of the desktop ads now as well. Over the last few days I have noticed several of them trying to install invalid/revoked security certificates on my PC. The certificates are coming from search.spotxchange.com and the ads are so persistent that once they show up it's impossible to do anything except shut down the browser since they continually retry the certificate installation when it is rejected. I wouldn't be surprised if many forum users are now "trusting" this spam source without even knowing it..

Ad blockers do prevent the problem by blocking the ads, but that doesn't change the fact that a popular tech site like AnandTech shouldn't allow malicious ads at all.

 

[UsandThem]

There must be some type of exploit (especially with Android OS). After my last phone received an update in late November, whenever I went to my usual news sites and other places (including Anandtech) I have gone to for years, I started receiving those same type of popups. I eventually even factory reset my phone thinking I had malware or something on it, and even without installing my apps, I started getting hit by the same pop-ups.

I noticed over the past several months that when on my PC, I would get "site not secure" warning when coming to Anandtech Forums from Norton, and it recommended not going to it because the connection was not secure. I trusted the Norton warning and did not go any further. Then later on when I would try it again, I wouldn't get any warnings from Norton, so whatever was hijacking the site or ads was fixed.

At least now I know I'm not the only one who had issues with this.