0

Recently I have seen a lot of these:

This is not the typical "fake pop up" trying to have you tap on it and redirect you to the Play Store. This pop up actually replaces the tab I'm browsing, and is trying to have me go to the play Store to install one specific app.

Everything in this phone comes from the official Play Store, and the phone is not rooted.

For SEO sake, here are the domains used in this scam:

eu.sustainable-49.xyz samsung.giveaway-deal-com.xyz us.east-85.xyz

Here are a few screenshots:

The text basically says that my phone is infected and I NEED to install those applications, or that I have won something and I need to something (I didn't follow in that case..)

enter image description here enter image description here enter image description here enter image description here enter image description here enter image description here enter image description here

In one case, this leads to this application, which contains this comment (from yesterday):

enter image description here enter image description here

Hi, thanks for your feedback. We’ve found that some ads/redirected pages may be malicious promotion from unknown channels, slandering us on purpose. Would you please be so kind that next time you come across the pop-up ads, please send us the link/spam/redirect pages or a screenshots to our Email: cleaner@duapps.com. Thanks a million.

I'm not sure whether this is a local attack on my smartphone, ie an app which would somehow mess with Chrome, inject some code in the pages, or an attack on those websites, or a compromised ad network. It's a bit hard to tell exactly when this is happening.

Could you suggest a method to capture this behavior next time it happens so that I can understand why this is happening ?

Here is one example:

1/ click on Google search result 
2/ now I am on some domain on forum-actif.net
3/ redirect to android.earix.com
4/ some data containing this url: go.onclasrv.com/afu.php?...
5/ redirect to onclickads.net
6/ us.east-85.xyz -> virus notifications leading to some Play Store App

Another example

1/ m.wikipedia.org
2/ orange.com-getprize.net



1/ bfmtv.com (French news TV website)
2/ redirect to eu.sustainable-49.xyz/fr002rd/redirect.html?model=Nexus%205&brand=Google&browser=Chrome

This leads me to think that the attack could be from a malicious app on my smartphone, because there is no way this is happening because of a compromised ad network on wikipedia.org.

  • 1
    Seeing them all originating from .xyz domains I'd say you visit too many spammy sites (no offense meant). Administrating a mail server for multiple domains, I've noted a lot of spam for/from those domains, too. Those popups are most likely Javascript from the sites you visit. So to get rid of them, don't go to those sites – or disable Javascript for them, or use an Ad Blocker (or a browser that has such integrated). – Izzy Jul 29 '16 at 15:34
  • @Izzy Unfortunately, this weird behavior occurs on my smartphone on news.google.com and some other reputable news sites.. I just don't know how to really understand what's going on. See my edit. – alecail Jul 29 '16 at 18:46
  • That makes one of the cases listed in the answer of pzmarzly a likely cause then. – Izzy Jul 29 '16 at 19:50
  • If there is something malicious between your device and the site you are trying to reach, try surfing by 3/4G vs Wifi. If it doesn't appear in the former but only in the latter and only on your home network - you have problem at home. – LosManos Jul 29 '16 at 21:26
  • You can also share your network from the device and have a computer connect. There you can surf to the same site with some dev tools on and look for anomalies. – LosManos Jul 29 '16 at 21:29
3

Cause of your problem is probably:

You can try:

  • using other browser
  • entering sites with HTTPS - try for example typing https://new.google.com/

EDIT: How to capture redirections using Chrome Developer Tools?

  • download Google USB Drivers & ADB on your PC
  • plug your phone in
  • run adb devices, it should say your device is unauthorized
  • on your phone, you will get a window, select "Always trust this computer" and Yes
  • open Chrome on both your PC and phone
  • on PC, open Developer Tools on any page (f.e. about:blank)
  • select (hamburger)->More tools->Inspect devices...
  • make sure USB is checked
  • your device should appear on the left
  • run https://www.google.com on your phone (or any other working site)
  • on PC click on your device and select Inspect on your working tab
  • go to Network tab and select Preserve log checkbox
  • select Doc tab
  • navigate on your phone and see every HTML document your browser loads (it sometimes may go to Other tab)
  • Good listing! Add one item: manipulation of the data flow by the network operator. Some of those have been known to inject ad urls in the past, see e.g. Website-Targeted False Content Injection by Network Operators (find more). – Izzy Jul 29 '16 at 19:49
  • Could you suggest a way to find why the URL of the current tab is suddenly changing without my intervention ? I can find the new location in the history, but I don't know how to debug that on in Android Chrome. – alecail Jul 29 '16 at 19:56
  • @alecail I've added it in my answer – pzmarzly Jul 29 '16 at 20:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.