Fraudulent pop ups occurring

jjp8182 · Nov 4, 2020

Just got it twice this morning using firefox on a PC - after not seeing it at all yesterday afternoon/last night. Per request the URLs were:

://getbestakamaitheclicks.best/VWr24XBTaPCjfAOpscuxoX2E8UzYJsC8KMsZnKrV4Lo?cid=weftfnqqr3qp4c43i7juouoa&sid=59eb0dc544d87e5e8133cd1837c423c7&uid=LBMtFKLEQFoRVia9qmWChgjj]Firefox]

://protects.s3.us-east-2.amazonaws.com/secure/d/index.html?s=Alabama&i=173.21.151.190&c=Harvest&br=Firefox&os=Windows&tid=a9144b5c-bce6-4016-b6f4-d9de52db407f&cep=v1RkHscozcmQWDNf_UNw1wuO8tJ2endSK_49OvjAkjEGIo1RVPR7D4rSKm7_vjFPNp1Ra9OQLHcIt8L3U0NmXrswClM1nfXb05EkFg70yOzbiAjlzDAjQ3MuJ4hu1cQQEikyj3wt3rL6G8aXG5GzxFttP8RbKY7wdrVDe4tohs5wyTrXqBk0GQcIpi4THUUl5aF-zvtCPu_d7HunuTU51vd8nU76wuE_mP_qVx7d2FZcSb7OU-ROJG_3lUUKMzEyUQLgjGO7w9cQdtM9SCgw9qbUhE9uT-VEpDr2KQIZOyXs-GBLuAXG6dSblUcY_RsKbqq-DA95Sl-01JA951PnCAwvqgvkoUPTZ6-msyXw5d84FKtfbhW9wF9Ji8Is-FhPp6EfErZvjsFGhb2QS7dtLB-U7OJq1HJaJP6rnYDsmJCN_wbbOm0GtRYmTBD274PBZr340VtDm0bckN0FAIXiAA&lptoken=166104ef490b60d06374]McAfee]McAfee Antivirus Protection Expired

...and another

://device-checkup-now.com/?lander=xbv6ojr5dh68b3&p=ma96u28r3qih5eklps&halert=1&campaign=38749ce1-eb83-4cd6-a5bf-1d0950d2ea64&lander=fa8ab0c9-843f-4cdb-94e5-418acf01ce84&source=29d2f2ed-2a59-4a23-80d3-db396211ac70&brand=Desktop&model=Desktop&os=Windows&osversion=Windows%207&browser=Firefox&isp=Mediacom%20Communications%20Corp&ip=173.21.151.190&city=Harvest&region=Alabama&dom=new.checkup-scan.com&t=https%3A%2F%2Fnew.checkup-scan.com%2Fclick%2F1&cep=ONAJ1B1FDDMgFixIuK1-YlWDyb5D_NaUsdjSMJPDT-17j4a8pVsrDidcEegvmLzaRd3C8NRlVRPlBn4kfFoV-uCmpIytgGhR5adEIhBRgJWktrs0y--yh9Yd5QyrSuOQyuSC4WZpUkmwUmc66qiGskCYw2X748hWBpx9EmASYDNUC6rBmmKWQ2gIOMI2KHr5N7H5v4oYrroYCL7QV4o0hz5zetj8s30QC-yHgyRhe4d2RqcFbzHoqEQ-79k18c9rNPAOyCYBXHhj82z_2fgYMUsvaqQWsybPOkrm6HzCBWTxdVDxmAaEYU8cJtfEv3jnSwnBCV0W3CywPeDR3QOYFeZFJdUz_c1efZr2qVPwfQfsubxBKlLQoEdDbDgPb4XNp4s66EYKd3HSfrIXLqc3GtwRNhMivbNKGjFnFl_9ft1iG1ZkhQI_OhYBOBNVfGBsN5qRPOPlXAgREbr9zONXAhkQHHASf0GpEQywq5Q7AXlZ4CtM2LGa7cpFCG3kjTPLDR7RPTRRlcRYoKwjMrDuzMk6-rUMP37_oVdYnry9fbgGSMIC22rcQxDBoniNqZtfU0qjqopKIOywK4L74wbew_iR9FBZztXeoSsJJAwZ-JO0oVQsLruLe-d_nEKSsLCo&lptoken=1687041549af63c04200&v1=alpha-coy-kmg2djhmb&v2=terracotta-hog&v3=1450711&v4=&v5=DOMAIN&v6=&v7=US&v8=Windows&v9=Firefox&v10=unknown&v0=0.092000&cid=dv0bac92d71e9d11eb8ac80a1c4c64d1fb3bea574cef2846608af1ce0eafddaf91051228399715fdb2a8

Edit: added third and removed https from urls

...while hitting the backspace key seems to bring me back to the forums these popups are repeating quickly enough to make the site nearly unusable this morning (again)

fried1765 · Nov 4, 2020

jjp8182 said:
Just got it twice this morning using firefox on a PC - after not seeing it at all yesterday afternoon/last night. Per request the URLs were:

Firefox update

McAfee Antivirus Protection Expired

Yup......that's the same two!

Ford850 · Nov 4, 2020

Just got it a few times this morning after turning off AdBlock Plus. It happened once on several threads including when I came back to this very thread to report it.

It redirected my browser to h t t p s://propcscan.com/mc/#
So now my AdBlock Plus is back on for TBN.

MossRoad · Nov 4, 2020

Getting it again this morning. View a page for about 5 seconds, then it pops up. Back key goes back to the page, but 5 seconds later it comes up again.

here's the URL that I got, minus the HTT part so it's not a link anyone can push

ps://werrew.yica.pw/AwGizgbrpaPD03aV790i3cysJgxlCdRClRyPjvXi8jbmOL4NxJtCFY6v_DCQAYhNVgIqwXYp5j3-UYgOOCxevxvsDcEzgrc_yNIqcfo_vnQCcA==?p2=59eb0dc544d87e5e8133cd1837c423c7&ci=wg27ea3om4l6rd43ioog6p04&n3er=xc_Etg==&uu=lIaJhrzOpHZ7gHl5fnuIdnt6h3k=

Mat4644 · Nov 4, 2020

Muhammad said:
Please post the url you were at as well as your device type and browser so we can narrow it down.

Checked multiple devices Apple - Windows - Android. Multiple browsers. All devices clean and scanned. Problem appears embedded on your side.

LS Tractor Owner · Nov 4, 2020

Yep, getting the same screen pop up again this morning.... no way to close it except to close TBN, then reopen. This is on an
iPad

Muhammad · Nov 5, 2020

Still working on this. It's not malware on our site but rather coming in through an ad network. So it's more difficult to track down. Thanks for your patience.

Muhammad · Nov 6, 2020

How about now?

jjp8182 · Nov 6, 2020

I haven't seen any in the last ~30 minutes of catching up here this morning....

Jstpssng · Nov 14, 2020

They're Ba-ack!

rangerfredbob · Nov 14, 2020

yeah, I'm getting the ads on the bottom of the page again as of last night too, they're really annoying when you are typing and it shows up right over the reply box... If it helps I'm using chrome and the adds have been for I think LS tractors, Home Depot and Angle Soft TP... kinda a odd combo if you ask me

Muhammad · Nov 14, 2020

Please be more specific: which pages are you seeing them on and if possible include a screen shot. Thanks.

LS Tractor Owner · Nov 16, 2020

Here are a couple of screen shots that occur whenever a thread is opened.... quite annoying!

LS Tractor Owner · Nov 16, 2020

And another, as soon as I submitted to this thread!

fried1765 · Nov 16, 2020

LS mt125 owner said:
And another, as soon as I submitted to this thread!

Pop up blocker works great!

LS Tractor Owner · Nov 16, 2020

fried1765 said:
Pop up blocker works great!

It is on already! They keep sneaking through.... don't get popups on any other site!

fried1765 · Nov 16, 2020

LS mt125 owner said:
It is on already! They keep sneaking through.... don't get popups on any other site!

Pop up blocker fixed it for me here on TBN......I sure hope it lasts!

Grumpycat · Nov 16, 2020

LS mt125 owner said:
Here are a couple of screen shots that occur whenever a thread is opened.... quite annoying!

iPad?

Brave Browser has a better built-in blocker than any add-on I have found.

LS Tractor Owner · Nov 16, 2020

Grumpycat said:
iPad?

Brave Browser has a better built-in blocker than any add-on I have found.

Yep, IPad.... the popups have miraculously disappeared by this afternoon....

rangerfredbob · Nov 16, 2020

I haven't gotten any this evening but got several when at lunch at work, both on Chrome. I will take a screen shot next time before I close out... It has never happened on the main index, always in either the next layer or on individual threads, and didn't seem to matter which one I went to, sometimes got two in the time I was reading...