Pop ups in Chrome trying to have me install an application, how to find the root cause?

Question

Recently I have seen a lot of these:

This is not the typical "fake pop up" trying to have you tap on it and redirect you to the Play Store. This pop up actually replaces the tab I'm browsing, and is trying to have me go to the play Store to install one specific app.

Everything in this phone comes from the official Play Store, and the phone is not rooted.

For SEO sake, here are the domains used in this scam:

eu.sustainable-49.xyz samsung.giveaway-deal-com.xyz us.east-85.xyz

Here are a few screenshots:

The text basically says that my phone is infected and I NEED to install those applications, or that I have won something and I need to something (I didn't follow in that case..)

In one case, this leads to this application, which contains this comment (from yesterday):

Hi, thanks for your feedback. We’ve found that some ads/redirected pages may be malicious promotion from unknown channels, slandering us on purpose. Would you please be so kind that next time you come across the pop-up ads, please send us the link/spam/redirect pages or a screenshots to our Email: [email protected]. Thanks a million.

I'm not sure whether this is a local attack on my smartphone, ie an app which would somehow mess with Chrome, inject some code in the pages, or an attack on those websites, or a compromised ad network. It's a bit hard to tell exactly when this is happening.

Could you suggest a method to capture this behavior next time it happens so that I can understand why this is happening ?

Here is one example:

1/ click on Google search result 
2/ now I am on some domain on forum-actif.net
3/ redirect to android.earix.com
4/ some data containing this url: go.onclasrv.com/afu.php?...
5/ redirect to onclickads.net
6/ us.east-85.xyz -> virus notifications leading to some Play Store App

Another example

1/ m.wikipedia.org
2/ orange.com-getprize.net



1/ bfmtv.com (French news TV website)
2/ redirect to eu.sustainable-49.xyz/fr002rd/redirect.html?model=Nexus%205&brand=Google&browser=Chrome

This leads me to think that the attack could be from a malicious app on my smartphone, because there is no way this is happening because of a compromised ad network on wikipedia.org.

Answer 1

Cause of your problem is probably:

• DNS injection in your network (check other devices, try setting DNS to 8.8.8.8 / 8.8.4.4)
• Man in the middle attack in your network (check other devices, try enabling Data saving in Chrome settings)
• weird unknown Chrome data corruption - try going to Settings->Applications->Chrome->Clear data & Clear cache
• Google Ads script injection - try disabling ad personalization as described in provided link
• virus - use Malwarebytes Antimalware for Android

You can try:

• using other browser
• entering sites with HTTPS - try for example typing https://new.google.com/

EDIT: How to capture redirections using Chrome Developer Tools?

• download Google USB Drivers & ADB on your PC
• plug your phone in
• run adb devices, it should say your device is unauthorized
• on your phone, you will get a window, select "Always trust this computer" and Yes
• open Chrome on both your PC and phone
• on PC, open Developer Tools on any page (f.e. about:blank)
• select (hamburger)->More tools->Inspect devices...
• make sure USB is checked
• your device should appear on the left
• run https://www.google.com on your phone (or any other working site)
• on PC click on your device and select Inspect on your working tab
• go to Network tab and select Preserve log checkbox
• select Doc tab
• navigate on your phone and see every HTML document your browser loads (it sometimes may go to Other tab)