Kitz Forum
Announcements => Site & Forum Discussion => Topic started by: skyeci on October 05, 2016, 09:03:35 PM
-
Hi.
I generally view the site from my s7. Just recently when I visit the site and click on a post I get a pop up spam advert which is annoying to try and get rid of. Whilst not implying any issue with the site can anyone offer some help please. I have scanned the phone and run anti virus but cant find any issues?
Many thanks
-
What does the popup say?
I dont display any popups at all. The only ads are in the header (near the logo).
-
Its an ad for tesco. Will try and grab a shot of it.
-
skyeci I suggest reviewing apps on your phone also, as it may be one injecting the popups.
-
skyeci has sent me a screenshot of the image (attached below).
I'm pretty sure that it isnt anything to do with this site, there seems to be quite a lot of these sort going around atm, possibly introduced by a downloaded app. Do you use facebook, as that is another place where some of them seem to originate. Ive seen something similar myself on the PC which was in effect from a link which was on my fb wall.
I note that chrys has also suggested it may be from an app. Try rebooting into safe mode and see if its still happening.
-
Link for S7 safe mode
http://www.technipages.com/galaxy-s7-turn-safe-mode
-
Another link which may be helpful
http://forums.androidcentral.com/ambassador-guides-tips-how-s/630081-guide-malware-adware-popup-removal.html
-
Thanks for the links/tips. Will look into this. The weird thing is its only happening when I visit kitz.. ::)
-
Yup still happening in safe mode ???
-
Any possibility that rather than a pop up, you are accidentally clicking on an ad-banner?
That happens to me a lot these days on my ancient iPad 2. There is such a long lag between tapping and getting a response that it is tempting to tap again. But the second tap lands in an area that, when the first tap responds, is an ad-banner, and I see effects similar to described here.
PS: these 'similar effects' refer to the general Internet, not Kitz. I don't recall any specific effects on kitz's pages.
-
Been looking at things for about the past hour or so, but cant find anything coming from this site that would trigger it.
There is lots of stuff on the net for others seeing similar types of popups and indicating its usually introduced with a rogue app, but I dont know why it should only be happening when you visit here.
the domain where its originating from (s1lxdc4pey.pw) is also highly suspicious as the TLD pw is often used for malware and spam. domaintools shows whoever it belongs to appears to have covered their tracks. -link (http://whois.domaintools.com/s1lxdc4pey.pw).
There's an example of another .pw popup scam here (http://www.bbc.co.uk/news/technology-31129797).
Have you tried clearing your cache to make sure its not anything in temp files.
Malwarebytes have an app for mobile devices which I think is free, and may be worth giving it a shot https://www.malwarebytes.com/mobile/
PS
I also put a block in place with adsense on that domain just to ensure its not coming via google ads.
-
If its possible on a mobile browser, I expect it be very difficult if it is due to the small screen, try loading the site in developer mode which may give some more insight into whats going on.
-
I have to chip in here and say I've had this 2 or 3 times on here using my mobile. Samsung S5 using chrome browser. I remember about a month ago it happened and I reloaded the page over and over to see if it would happen again and it popped up every 5th reload of the page.
I was pretty sure at the time it came from the main banner at the top, though may be wrong there. The banner had a pattern when reloaded like Sky, Talktalk, BT Sport, EE, then the next ad was blank and chrome mobile would open a new tab/popup and the phone would continually vibrate till I closed the tab.
Clearing the cache stopped it happening, making me think at the time that the 5th banner was a targeted ad and something in my cache was triggering it.
I visit here on my phone at some point everyday and it's only happened a few times. It happened a few days ago with that exact ad that skyeci screenshot.
It wasn't (and isn't) a huge deal to me so didn't want to create a thread about it incase it looked like I was having a moan. Thought I would chip in with my experience seeing as someone else brought it up.
I have adblock running on my PC but exclude this site, as I do with a few smaller sites who's ads aren't intrusive. I don't want to deny much needed revenue. I've never had a popup on my PC from here, only my mobile.
-
Many thanks for the replies. It seems it has managed to get past avg and malware bytes. I have had these running since owing the phone and both report no threats or issues.
I have tried it again and it still happens. I note its on the 5th click of a post. The only way I have found to stop it is to install ad bloc for samsung browser. This has now stopped it...
very strange as only started a few days ago..
-
@John - Thanks for the info. The 5th rotation means that it is google ads.
I sat last night for another hour or so, but I cannot re-create this here using Desktop, Galaxy tab S2, a galaxy s4 or an S5 Neo.
Obviously I want to try and get to the bottom of this .
Rotation should be
1) Google
2) Sky
3) TalkTalk
4) BT
5) EE
@skyeci. Can you do me a favour please.
- Can you tell me what browser you are using
- Have you cleared your cache
- Do you have a google account and profile and are you logged in
- What settings is your browser using for ad prefs?
As regards to the last item. This is something controlled on the local machine and set by you for the browser. Unless you are logged in to a google account, settings I believe are kept in a cookie. Its not anything I have control over and everyone should set their own prefs for each browser they use.
Information about this is Ad prefs (https://www.google.com/ads/preferences/html/mobile-about.html). From there you should get a link to change your browser ad prefs. eg my link (on a desktop) goes here (https://www.google.com/settings/u/0/ads/authenticated?hl=en).
I enclose below a screen cap of my settings.
- Interest based settings - OFF
- Control signed out ads -
Ads based on interests beyond google - OFF
Google search ads based on interests - OFF
From memory it sometimes also asks me about YouTube Ad prefs.
@skyeci again
- If possible, can you tell me -or even better screen cap - what the 5th image is that shows in the header (example for me below which is a different BT ad, but seems to change to things like VOiP, Logitech etc)
- Can you screen cap again the popup image again as I want to see if it is still being served from the same url - Im suspicious with it being a string and wonder if it changes.
I have a block on that url and Im also quite strict on any ads that I serve via google and I try to keep ads to a minimum. All 'sensitive' categories should be blocked. Personalised ads are blocked (Personalised ads – show ads based on users’ interests, demographics and Google Account information, and allow Google to collect visitation information from my site to create interest categories). VPAID ads are blocked.
Ive also put a manual block on that url, so I cant understand how this is happening :(
-
@chrys (or anyone else)
Any ideas what could be going on here?
I suspect its picking up some type of settings from somewhere. My guess would perhaps be on the local machine google ad prefs that may possibly have been introduced by either an installed app, or another site.. or I dont know. Ive been reading around and some of the ad hijackers deliberately may wait a for 'x' period of time to start generating the ads to throw you off the scent.
If its ad hijacking then I would have thought clearing cache/cookies should clear it as that resets ad prefs.
Adblocking is probably just masking the issue and what ever its doing will still be going on in the background, just not displayed.
Whatever it is, it seems selective and showing on android devices where unlike on a PC its going to be harder to track down what is happening.
Otherwise google has a more serious issue.
-
Is it possible that there is something bad happening in the browser itself, confined to the local machine? Some adware installed? An alternative browser (can't remember if you've already done that) might not be a good test if the different browsers share common code or common settings.
Or if not the local machine, what about an attack on the DNS or on the router? Could try hard coding the DNS server settings to go directly to an alternative server e.g. 8.8.8.8 or the OpenDNS ones? A netstat would be interesting, to see what the open TCP connections are.
It's a long shot, I know.
-
>> Is it possible that there is something bad happening in the browser itself, confined to the local machine?
I'm laying bets on its something to do with the ad prefs which are stored as a cookie for each individual browser. Clearing cache and cookies should reset this, which is why J0hn's fixed when he cleared his cache.
What I dont know is how or why it shows those tesco ads (which arent really tesco ads). Ads served by google generally are supposed to be relevant to page content. The page content is quickly analysed and advertisers bid to display. All this happens rapidly. The reason I see VoIP or BT served ads is because they are relevant to content.
There is one other important setting (personal local machine settings) which I always have switched OFF and thats the "Interest based settings". If its on, then it will pick up items that you may have previously searched for, or looked at.
This is why if youve been looking at new kitchen units, rather than display ads based on my site content, then you will be served an ad from someone like B&Q or whatever. That's nothing to do with me, its based purely on where you've been or what you've looked at some time in the past on some other site, and that's where the cookie is originally set.
Then when you visit some other site sometime later who serves google ads, then that will over-ride the site content based ads.
I dont understand the full workings - I dont think google discloses it, but what Im guessing is that somewhere along the lines something has been set for personal prefs. I tried my damndest last night to recreate it on both phones (one with Voda, the other EE, both galaxys) I switched off prefs and I even went to Tesco's hoping it would pick something up... but it didnt. This is why I strongly suspect that the cookie had originally been set from another site or a downloaded app.
Because its a cookie, then safe mode wont over-ride it. MBAM is designed to look for virus and exploits. This is just a damn annoying spam thing so unlikely to pick it up either. :(
Any other thoughts on where/how it could have been picked up appreciated.
-
A little bit more info kindly provided by Skyeci.
All the ads that were displayed to him were for android based apps (ie bounce mobi, fruit killer, android pay) Not a single ad based on site content that I would expect. This certainly suggest something was over-riding content based ads which should normally display from here.
The good news is that all is now good and its gone, but he is keeping his eye on it.
-
Sadly i am not convinced its malware, I made that assumption based on the fact I know you try to avoid abusive ad's but ultimately when relying on a third party, you are at their mercy in terms of them been secure and behaving themselves. Now John has confirmed the same issue and you also confirmed how your ad's rotate it does seem an advertising issue.
I run an adblocker on my phone plus dont even use the browser for this website which is why I probably have not been affected as tapatalk has its own ad system.
-
Even though I have cleared everything down,de-installed ad blocker so returned to the original config and disabled all the google ad settings for signed out and signed in preferences there is no popup but I am still seeing one rouge header in the banner. I keep seeing this one for voip..it leads to
Its on every 5th banner and now showing the ad choices button in the corner that leads to google ad choices....
https://www.port5060.net/?gclid=CNqKieWNyM8CFUMq0wodrfsJFw
-
The VoIP one is genuine and shows things are working correctly. (Telecoms/voip) The Adchoices button (https://en.wikipedia.org/wiki/AdChoices) also helps show its legit - it should take you to a link whereby you can set any personal ad preferences on the local machine.
tapatalk has its own ad system.
They (https://blog.tapatalk.com/knowledgebase/what-are-native-ads-in-tapatalk/) also will use a 3rd party supplier, with native marketing its just more merged into the content.
Sadly i am not convinced its malware, I made that assumption based on the fact I know you try to avoid abusive ad's but ultimately when relying on a third party, you are at their mercy in terms of them been secure and behaving themselves. Now John has confirmed the same issue and you also confirmed how your ad's rotate it does seem an advertising issue.
No its not malware, I said that in my post above (http://forum.kitz.co.uk/index.php/topic,18656.msg335026.html#msg335026). I'd been looking into the types of ads that were served and think it may be something stored in a cookie that was over-riding what I would normally serve.
The fact that clearing cache sorted it would indicate that it was cookie based.
I am very strict in what I show. I opted out of personalised ads (https://support.google.com/adsense/answer/113771?ctx=tltp&hl=en) [1] and have all sensitive categories blocked [2]. Ads are kept to an absolute minimum. Far less advertising than other sites and most sites don't even bother doing [1] and [2]. Both of these settings mean less revenue.
Google serves ads depending on the following
Types of websites you visit, and mobile apps you have on your device
Cookies on your browser and the settings in your Google Account
Websites and apps you’ve visited that belong to businesses that advertise with Google
Your activity on another device
Previous interactions with Google’s ads or advertising services
Your Google Account activity and information
What is strange in skyeci case is that all ads were for android apps and android pay. That is not content based advertising and suggests its picked something up from a previous activity. I also tried putting a block on the the bad url in my custom blocks, but it still continued to serve.
Why would it clear when cache was cleared.
As you know sites like this rely on ads and donations. Its tough - and I do mean really tough -trying to cover costs.
-
Spotify ads 'launched virus pop-ups'
http://www.bbc.co.uk/news/technology-37573815 (http://www.bbc.co.uk/news/technology-37573815)