Suspicious behaviour.

[R Soul]

Hi.
While browsing the forum I suddenly saw this:


It seemed to resist normal attempts to ignore it (but it was no match for Task Manager). And of course asking for a username and password? Very subtle.

I haven't seen this anywhere else (yet) so I'm reporting here in case on of your ad banners has been hijacked.

 

[AndrewBo]

Can you please take a look ? @Dave Stephenson Thank you.

 

[R Soul]

I just got another one while viewing this thread. The address is different and behind it the spoof website has a screenshot of the message box.

None of these addresses are getting any results a google search, so they must be new.

 

[AndrewBo]

@Neilski @Dave Stephenson Bump

 

[Neilski]

Hmm. @R Soul - how confident are you that your PC/browser isn't harbouring some kind of infection? (And of course, is this site still the only place you've seen the issue?)

 

[R Soul]

Very confident. I don't spend long on this forum, so the chances of a more general infection only showing itself here are very low.

In fact while I was typing, I paused to think about anything else to add, when something similar happened.

First I was taken to this site:

Then it very quickly redirected me to:

To get the first screenshot I had to go back from the second one and take a screenshot before being redirected again.

This time I didn't see the fake Mozilla background, nor the login box. I have AdblockPlus (not enabled for racedepartment of course), but that may have stopped anything further from happening.

If I experience this problem on any other site I'll let you know, but I think it's unlikely.

 

[Neilski]

Thanks for the update. I'm trying to work out how to debug this (and not getting very far yet). I can't reproduce it no matter what I try, but adverts are usually (somehow) targetted based on location and other things so that perhaps shouldn't be a huge surprise.
Have you tried Chrome? It would be interesting to see if the problem ever shows up in another browser.
Also, is it possible to save the RD page you're on when the problem occurs? I'm hoping that the rogue advert might show up in the saved data (maybe in a script).

 

[R Soul]

I've had this page open in Firefox and Opera for quite a while (while doing other things) but the dodgy page hasn't appeared in either of them, so I don't know whether or not it's browser specific. If no-one here has changed anything, it could be that the script that chooses adverts has simply moved on to another.