New Ad prevents site from loading on mobile

[chobbes7]

One of your ads is blocking any access to the website. As soon as the ads load in, one of them is firing off some code that warns about viruses on my iPhone and takes you to “hxxps://phone-shop-marketing-application.pw/“ to enter your credit card number to run a virus scan on your phone.

It’s impossible to use the site because you keep getting redirected away and they do the thing where they redirect you a few times so hitting back takes you back to their site, not back here.

Only way I’m posting this is I added RepGeek to the ad blocker list so I don’t get anymore ads. I like to keep sites I want to support whitelisted, but I literally can’t use the site anymore.

[TingelTangelTom]

Yes, a Scareware ruins access to RG from iPhones.

[mysterio]

Have you tried opening the site on another browser aside from the default Safari one?

[TingelTangelTom]

On my PC its no Problem, maybe because of the AntiVirus. On my iPhone i just use Safari. I noticed this Problem since Friday evening.

Disabling JavaScript prevents this Scareware from starting.

The Script most likely is hidden in one of the Adds

[mysterio]

On my PC its no Problem, maybe because of the AntiVirus. On my iPhone i just use Safari. I noticed this Problem since Friday evening.

Disabling JavaScript prevents this Scareware from starting.

The Script most likely is hidden in one of the Adds

Have you tried using Chrome on iOS?

[TingelTangelTom]

No. And dont want to.

The Problem is not Safari - it´s the Script on RG.

[marco130]

Two days now that Ive been getting that pop up.

Had to go on my PC and reset passwords. Hope you fix the problem.

I'll check back on my I pad from time to time to see if its back to normal.
This issue is only on RG. No other sites with this issue.

Good luck

[QuattroMan]

The same for me with Safari and iphone / ipad.
Without Javascript it works.

[TingelTangelTom]

Now the Text changed for me. Its no more Virus Alert-Scareware-scam , its is now the "you won an iPhone Scam" from the same source.

This is a very well known Scam attempt. It gets on RG from the Provider of the Adverts. One of those adds contains this malicious Java Script.

[chobbes7]

Yes, I only use Chrome on iOS.

Safari is the one I use when I want to block ads because it’s easy to integrate the third party content blockers in. I’m on Safari now with adblocker and I can use the site.

As soon as I turn it off or try on Chrome, I can’t load a single page without being redirected away by some hijack ad.

[chobbes7]

Here’s what happens right now in Chrome for iOS. As soon as the page loads, it shows this and when you hit OK, you go straight to the scam site.

I’m also posting because it’s LOL.

We want to thank you for your loyalty to Google and offer you an oppotunity to win a free iPhone

[marco130]

I'll try it again tomorrow Hopefully it will be working soon.

Cheers!

[kilowattore]

I get repeated "blocked address re-routing" (or similar, its in italian) alerts on chrome for android

[Fiesta63]

I've got the same on iPad, have just disabled JavaScript and it's gone and allowed me to post, only happening on repgeek no other site,

[DaleM]

Android rules! lol

[chobbes7]

So i backtraced the request which is causing it. It seems to begin with this ad from VLN

The ad image looks like this:


The BagsForULife page loads a file called https://bagsforulife.com/scripts/ga....tVUkxfSEVSRQ==

Now it's already fishy that the file is called "ga.js" because that's the filename used by Google Analytics. Someone is trying to make it seem innocuous... but it stands out like a sore thumb with that giant base64 value on the end. That link value is base64'd and it's like the referrer URL because it equates to: https://www.repgeek.com/adserver/www..._CLICKURL_HERE

That leads to a piece of JS loaded by 403 Forbidden which then loads a js of https://ie8eamus.com/sfp.js which makes an XHR request to load a JS file: https://pl14704305.pvclouds.com/2f/d...3cc3f29xxxx.js.

This file is heavily obfuscated, but after you deobfuscate it, you can see that it checks for mobile based on the browser's useragent and then hijacks the breowser

[TingelTangelTom]

As long as Repgeeks Admins don't see the need for Actions there is nothing we Members can do.

[Tucker]

I'm getting the exact same pop up when I attempt to access the site via my iPhone or iPad. Its only happens on RG and no other forum. It directs me to “hxxps://phone-shop-marketing-application.pw/“


I am able to access RG via my desktop using Firefox but I am completely shut down on my phone and ipad.

[breitlingno1]

It is needing to be fixed as it's a nuisance and makes the forum unusable for those using iPad or iPhone with JavaScript enabled.

[mosh_2k7]

Same here. Can’t access the site on both iphone and iPad. Keeps sending me to a site saying I’ve got a virus on my device!

[fortis Persicum]

I was getting it too on my iPhone. I didn’t get it right now when I tried the site. Seems like maybe the problem was resolved??

[Muttley916]

Problem still exists for me on IOS, cleared cache and history, still the virus message.

[Brobert]

Sorry for the inconvenience guys, we’re aware of the problem and working on it.

[AnthonyG]

I pulled the ads to verify it wasn’t from something else, clear your phones & iPads until I figured what they did

[marco130]

I had to reset my password but it seems to be working now. Thanks.