2

Something strange just happened to me, and I'm having issues telling where the fault is.

I'm currently travelling by train, and using my mobile phone as a personal hot-spot (WiFi is WPA2 secured).

I'm doing work-related things with some googling for MSDN articles and / or StackOverflow answers.

I decided to order lunch for when I arrive, and since I didn't remember if the site of a certain salad chain has its URL ending with .com or .pl, I googled it. Clicking on the link, I was redirected to something which looks like one of those reward scams.

Here's the link history as it is displayed in Firefox:
http://reward2650.cxzmoney5.info/default.aspx?u=bl3pte4&o=xbkkvzb&t=main&f=1 http://appstoresmobiles.com/away.php
http://best.prizedeal2.info/?utm_medium=ccb1966b9d7c2c6b97aced65bb3ff188a3ca62cc&utm_campaign=mainstream&cid=10f1ee16-ff68-49a5-983e-bb515c317d98

I'm a bit unsure about the order of these links, as one seemed to redirect to the other very fast.

Given that one of the links is "appstoresmobiles.com", I wonder if this isn't because my mobile phone is infected and / or was somehow compromised mid-request.

Attempting to do this again (i.e. googling the salad chain, clicking on the link) yielded the expected salad chain page.

Or (which seems least likely) the salad chain has had their page altered and redirects some requests?

Any idea what could this be?

Shaamaan
  • 380
  • 3
  • 12

1 Answers1

3

This looks more like your first Google link was actually an AdSense campaign, and the campaign itself had been subverted ("malvertising").

While Google strives to keep its campaigns free of evil :-), the market is so alluring that lowlife advertisers and outright criminals strive even harder to get their wares through, and squeeze the most out of the few hours' survival their campaign is all it's likely to get.

It has already happened (here too), several times.

LSerni
  • 22,521
  • 4
  • 51
  • 60