I'm having strange issues using Chrome Version 65.0.3325.181 (Official Build) on PC (Win 7) and OSX (10.11.6) on different systems.
Clicks are often being hijacked taking me to different sites (often gambling ones). Or alternatively, clicks are being filtered through redirect domains. This is happening on websites that I am logged into (some of which, worryingly, contain real-money wallets) as well as Google.
Two examples:
The most common one. I click a link. So fast that I don't even notice it, the click goes through an intermediate redirect URL. I only see this even for a fraction of a millisecond if for some reason the redirector is slow or breaks. e.g. clicking a link in google for a bike part takes me to the website but via
https://datds.net/replacement/click?place=1234&subid=abcd1234&href=http%3A%2F%2Fwww.chainreactioncycles.com%2Fbmc-sl-048-straight-edge-carbon-fork%2Frp-prod106545&replacement=5292&url=https%3A%2F%2Fwww.google.co.uk%2Fsearch%3Fhl%3Den%26ei%3DoW7WWtWpFuebgAbG4bGQDA%26q%3DBMC%2BCarbon%2Bfork%26oq%3DBMC%2BCarbon%2Bfork%26gs_l%3Dpsy-ab.3..0j0i22i30k1.7400.7933.0.8178.5.5.0.0.0.0.205.398.1j1j1.3.0....0...1.1.64.psy-ab..2.3.398...0i22i10i30k1.0.qtLNgCu6_XE
The place and subid query parameters are the same every time, I'm not sure about the rest.
There is another domain I've seen a few times which is r.srvtrck.com.
- Less frequently, I'll click a link on a site or on google and be taken to a completely different site. Again, it seems to be done through a redirect domain first and often sends me to gambling sites with affiliate information included in the URL. An example with be sending me to
https://mostmgb.com/?cid=85450330
.
This only happens a small fraction of the time and I can't find any pattern with linked-to or linked-from sites.
I've run Malwarebytes and checked the extensions on both systems and can't track down the issue on either. HOSTS files on both systems are clean and I'm not being led through any proxies.