General Discussion

SUSPICIOUS ACTIVITY - REPORT IT HERE
HippieVan at 8:24PM, Jan. 2, 2014
(online)
posts: 2,405
joined: 3-15-2008
We've been getting reports of some pretty bad ads and stuff recently. See the newspost about it HERE.
If you've seen an adult ad, had your browser redirected to another site, or saw anything on The Duck that seemed just plain sketchy please report it to us in this thread.
Alternatively, you can send a PQ to myself or ozoneocean, or email me at hippievannews@gmail.com

Please do your best to provide us with the following:
1. Any evidence you can gather: screenshot, url, source code of the ad.
2. What type of machine is being used (PC/Mac/Tablet/Phone/whatever)
3. Browser
4. Country/State (we suspect this may be a regional issue, but we’re not sure)
And any other info you think might be useful!

If you can't get all of that, please let us know anyways. The more evidence we can gather on this issue, the better.
Duchess of Friday Newsposts and the holy Top Ten
Have a comic milestone, a community project or some comic-related news you’d like to see in
a newspost? Send it to me via PQ or at hippievannews(at)gmail.com!
last edited on Jan. 2, 2014 8:29PM
kawaiidaigakusei at 9:08PM, Jan. 2, 2014
(online)
posts: 172
joined: 3-23-2007
Common ones that show up:





I should not really complain about this one. They finally got my orientation correct at least!



iPad2/Safari and Google Chrome
last edited on Jan. 2, 2014 10:46PM
Genejoke at 11:36PM, Jan. 2, 2014
(online)
posts: 3,060
joined: 4-9-2010
I got a load of stuff come up on my phone, to the point I couldn' visit the site without being redirected to download some alleged anti malware stuff.  
ozoneocean at 9:17AM, Jan. 3, 2014
(online)
posts: 24,940
joined: 1-2-2006
Thanks for the info Genjoke. Any specifics though? If you could give us even a few names of the antimalware stuff?
 :)
 
So far We've had reported in that vien: Java update, Firefox update, Flash update, and PChealthboost update.
 
On this site and no other normal site.  This site is etting exactly as dodgey as video streaming and song lyric sites. I would bet $100 USD that most free porn tube sites are cleaner than here.
 
HippieVan at 9:30AM, Jan. 3, 2014
(online)
posts: 2,405
joined: 3-15-2008
Just collecting these here to make things a little bit easier…
 
I'm not getting these on my PC where I have adblock, but on my iphone I'm continually getting redirected to this game:

…as well as another one called Clash of Clans. I've also been redirected to explicit adult websites a few times, and see the same ads as kawaii does.
 

 

 
Duchess of Friday Newsposts and the holy Top Ten
Have a comic milestone, a community project or some comic-related news you’d like to see in
a newspost? Send it to me via PQ or at hippievannews(at)gmail.com!
Banes at 12:37PM, Jan. 3, 2014
(online)
posts: 223
joined: 8-13-2008
 
Banes at 12:38PM, Jan. 3, 2014
(online)
posts: 223
joined: 8-13-2008
And here's the source code (I've also just been booted to the “War Games” site Hippy mentioned above.
Windows XP, mozilla firefox
irrevenant at 2:56PM, Jan. 3, 2014
(online)
posts: 330
joined: 1-13-2007
I had the same problem as Genejoke - a popup with only an “OK” button overlaid the screen so I couldn't go forward and back.  I'm on Android.
One of the links in question was lovelinks.us/red/mobo/360lp.php 

 
kawaiidaigakusei at 6:48PM, Jan. 3, 2014
(online)
posts: 172
joined: 3-23-2007
Reposting from Locoma's newspost comment:




I caught this screenshot of a redirect yesterday. The search bar specifically names nym1.ib.adnxs.com and when I looked it up, it is a type of malware.



——
UPDATE: You know, this is a crapshoot, but I just disabled Java on my safari browser then cleaned out the history and cache. I know Java can be a source of really bad malware. I am now not seeing any ads, but I also cannot see the featured comics on the front page. I will keep my fingers crossed that this can be a temporary solution.

——
After disabling JavaScript, I have not been bothered with any ads for hours (and counting). This is how I now see the welcome page:

last edited on Jan. 3, 2014 9:58PM
HippieVan at 9:02AM, Jan. 4, 2014
(online)
posts: 2,405
joined: 3-15-2008
Copying this here from the newspost:
 

 
Also, don't know if this is useful, but the url before I get redirected to whatever crazy site appears to be this: http://tracking.msales.com/incoming/click.php?b=153&rc=3
Duchess of Friday Newsposts and the holy Top Ten
Have a comic milestone, a community project or some comic-related news you’d like to see in
a newspost? Send it to me via PQ or at hippievannews(at)gmail.com!
irrevenant at 2:22AM, Jan. 5, 2014
(online)
posts: 330
joined: 1-13-2007
Just got it again. This one:http://lovelinks.us/wang/mobo/360.php
PaulEberhartd at 7:13AM, Jan. 5, 2014
(online)
posts: 27
joined: 7-21-2007
OK! It just happened at 4pm sharp. This url "http://www.updating-your-browser.org/Firefox-DE/“ opened itself in a new tab while I was reading the latest updates of ”Demons Mirror".

If anyone is really curious, I'll be happy to provide a full translation, but I think the short version “Click OK to prove you're an idiot” should be sufficient. ;)
It doesn't seem to be linked to the comic or certain pages though - it didn't do this when I went back and forth to reload the page. (btw. I'm using Firefox 26, German version “für Yahoo Deutschland yahoode 1.8” and the help screen assures me it's up to scratch).
PaulEberhartd at 7:19AM, Jan. 5, 2014
(online)
posts: 27
joined: 7-21-2007
Sorry! The first screenshot didn't work.
PaulEberhartd at 8:15AM, Jan. 5, 2014
(online)
posts: 27
joined: 7-21-2007
This one seems to have run in the background, keeping the comic I wanted to see from loading. It only appeared when I hit the “stop” button.

They're telling me in very broken German (Google Translate?) that I am (sic!) currently an outdated Java Plugin. This is the URL: http://www.autopartswarehousei.com/DE/?s1=HmXxDNLCMADdfHMBAAAAALvybwAAAAAAAgAQAAoAAAAAAP8AAAABEXf6RwAAAAAAb8J4AAAAAADhj4kAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABmlhUAAAAAAAIAAwAAgD8A-90gY0MBAAAAAAAAADQ3MGY3Yzk2LTc2MjItMTFlMy1iOGU4LWVmNGUwNTQzYmEzYQAAAAAAAAA=&s2=26109&s3=DE&s4=264382&s5=24345821
and this is its source code:
 
html>
head>
meta charset=“utf-8” />
meta name=“viewport” content=“minimum-scale=1.0, width=device-width, maximum-scale=1.0, user-scalable=no”>
title>Erkennt veralteten Java Plug-Institle>
link href="styles/base.css“ rel=”stylesheet“ type=”text/css“ />
link href=”styles/javaupdate.css“ rel=”stylesheet“ type=”text/css“ />
script type=”text/javascript“>
//auto target
var at = 0;
var at_delay = 2 * 1000;
script>
script type=”js/download.js“>script>
head>
body>
a onclick=”return downEvent();“ href=”javascript:;“>
div id=”wrapper“>
div id=”images/product.jpg“ border=”0“> div>
div id=”headline“>
h2>Erkennt veralteten Java Plug-Ins h2>
div>
div id=”images/x.png“ border=”0“> div>
div id=”update“>Sie sind zur Zeit ein Java-Plugin, das veraltet sein könnenbr>
Bitte aktualisieren Sie auf die neueste Version von Java (empfohlen) div>
div id=”terms“>
h1>Download von Java für Windowsh1>
p>b>Empfohlene Version 7 Update 25 (Dateigröße: 882 KB)b>p>
div class=”jvdl0 jvdl0v0“>
a href=”Installer.php?dv1=HmXxDNLCMADdfHMBAAAAALvybwAAAAAAAgAQAAoAAAAAAP8AAAABEXf6RwAAAAAAb8J4AAAAAADhj4kAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABmlhUAAAAAAAIAAwAAgD8A-90gY0MBAAAAAAAAADQ3MGY3Yzk2LTc2MjItMTFlMy1iOGU4LWVmNGUwNTQzYmEzYQAAAAAAAAA=&dv2=26109&dv3=DE&dv4=264382“>div class=”jvdla0“>
div class=”jvdl0x1“>div>
span>Zustimmen und starten kostenlosen Downloadspan>
div>a>
p style=”text-align:left; !important;“> strong>Durch das Herunterladen Java bestätigen Sie, dass Sie gelesen haben und die Bedingungen der Endbenutzer-Lizenzvertrag akzeptiert.strong> p>
div>
div>
div>
a>
div id=”disclaimer“>Disclaimer: Diese Website wird die Verteilung einer Installation Betreuer, der die Installation der ausgewählten Software verwalten.
Neben der Verwaltung der Installation der ausgewählten Software,Manager empfehlen die Installation zusätzlicher freier Software, dass Sie möglicherweise interessieren Zusätzliche Software Symbolleisten Browser-Add-ons, Spiel-Anwendungen, Anti-Virus-Applikationen und andere Arten von umfassen kann Anwendungen.
Sie sind nicht erforderlich, um keine zusätzliche Software, um Ihre ausgewählte Software erhalten installieren. Sie können das Programm vollständig zu entfernen, jederzeit in Windows ”Programme hinzufügen / entfernen“.
div>
script type=”js/jquery-1.7.2.min.js“>script>
script type=”js/msgbox.js“>script>
link href=”styles/msgbox.css“ rel=”stylesheet“ type=”text/css“ />

script type=”text/javascript“>
$(function browseralert(){
$.msgbox('ont style=”color:red; font-size:16px; font-weight:bold">Java Update!ont>r />r />Wird empfohlen,dass Sie auf die neueste VersionJava Update ,kommen um diese Seite zu sehen. r />r />Bitte um fortzufahren aktualisieren Sie.',
{
buttons :
}
);
$('button').click(function(e) {
//downEvent();
});
});
script>

body>
html>
Call Me Tom at 1:23PM, Jan. 5, 2014
(online)
posts: 203
joined: 10-28-2010

Is this what were looking for?
HippieVan at 2:54PM, Jan. 5, 2014
(online)
posts: 2,405
joined: 3-15-2008
@Call Me Tom: Yep! Anything like that…DD isn't supposed to have any popups or redirects. Any ads that seem inappropriate should be reported, too.
 
Anything else you can tell us like your browser/device you're using? Thanks!
Duchess of Friday Newsposts and the holy Top Ten
Have a comic milestone, a community project or some comic-related news you’d like to see in
a newspost? Send it to me via PQ or at hippievannews(at)gmail.com!
Genejoke at 12:48AM, Jan. 6, 2014
(online)
posts: 3,060
joined: 4-9-2010
I keep getting redirected by love links? I get a pop up that says my app store needs updating or some such then takes me to movie genie on the play store. 
HippieVan at 11:04AM, Jan. 7, 2014
(online)
posts: 2,405
joined: 3-15-2008
I came across this article today, which I suspect is at least a part of what's happening here. http://techcrunch.com/2014/01/06/shady-app-install-ads-are-automatically-redirecting-mobile-users-to-app-store-google-play/
Duchess of Friday Newsposts and the holy Top Ten
Have a comic milestone, a community project or some comic-related news you’d like to see in
a newspost? Send it to me via PQ or at hippievannews(at)gmail.com!
PaulEberhartd at 8:45AM, Jan. 10, 2014
(online)
posts: 27
joined: 7-21-2007
Had a good chuckle just now. Instead of a comic page I wanted to see, I got redirected to this link: http://adobe.softpoor.pw/FlashPlayer3/C/DE/update.php?installer=Flash_Player_11_for_Other_Browsers&browser_type=KHTML&dualoffer=false
.
So far so good. This is nothing new, but can you guess what it said on that page?
.
          502
   Bad Gateway
 _________________
         nginx
.
Now that's finally something we're all familiar with, aren't we? ;)
last edited on Jan. 10, 2014 8:47AM
HippieVan at 2:43PM, Jan. 13, 2014
(online)
posts: 2,405
joined: 3-15-2008
I haven't been redirected to any weird sites in the last couple days, although I'm still being forced into the app store. And my banner ads seem to have gone back to normal (ie no dating ads). Are other people still having issues?
Duchess of Friday Newsposts and the holy Top Ten
Have a comic milestone, a community project or some comic-related news you’d like to see in
a newspost? Send it to me via PQ or at hippievannews(at)gmail.com!

Forgot Password
©2011 WOWIO, Inc. All Rights Reserved