1

When I visit a link to an external site (like Huffpost) from within Facebook, I get redirected to a scammer site after scrolling a little bit.

enter image description here

enter image description here

Notice the URLs eu.unitize370vu.pw and eu.jargonize22bt.pw.

I am confident not having a virus on my phone, I don't install every app and nothing from unknown sources. What is this and where is it coming from?

I am using the latest and up to date Android.

  • Try installing a free mobile AV scanner, such as Sophos', just to check. Google Play tries, but it itsn't perfect at removing potentially unwanted apps (such as spam apps) – joedamarsio Aug 2 '17 at 12:55
2

It is a bit hard to believe that if your phone is infected, they'd need to show you ads. They can do far worse things. :)

If you're using FB in a browser, it could be one of two things:

  1. It could be AdTech going bad (i.e., some advertising network injecting ads).
  2. ISPs are known to intercept traffic to inject ads too.

I would try a different browser. I recommend FireFox Focus (a fairly new browser) as a remedy for such Ad nuisance.

  • I am using the Facebook App and when opening a link there, the redirect happens after scrolling. I am not using Facebook with the browser. – Daniel W. Aug 2 '17 at 14:07
  • My bad, I should've been clearer. If accessing from browser, you don't even need to click any links, they can just inject while you're using FB. But you did say "visit a link to an external site" first. So yes, even from within the FB app, if you click on links the ISP can inject ads - because the link would open in a browser (even if it is in-app browser). It is possible that they're using some algorithms to decide when to inject ads (e.g., after scrolling). Can't be sure without experimenting a bit (different browser, different ISP, ad-blockers, etc.). I can't think of any other reasons. – Sas3 Aug 2 '17 at 14:22
  • I understand. I think the chance of having a virus is about 10% but Ads with malware is about 90%. I do you see anything else causing these phishing sites to appear? – Daniel W. Aug 2 '17 at 14:25
1

As you correctly pointed out, this is indeed a scammer site, and has nothing to do with malware (malicious applications). Apps on the Google Play Store are reviewed by teams of specialists, so theoretically you cannot get malware from there. To make sure that no ¨unreviewed¨ app is downloaded, disable developer options (if you have them enabled).

Below is the evidence that leads me to belive that both sites are illegitimate.

I ran a whois on unitize370vu.pw, and the site was registered today:

Domain Name: UNITIZE370VU.PW
Registry Domain ID: D50760466-CNIC
Registrar WHOIS Server: whois.PublicDomainRegistry.com
Registrar URL:
Updated Date: 2017-08-02T08:21:12.0Z
Creation Date: 2017-08-02T08:21:11.0Z 

As for the other site, it was only slightly older.

Domain Name: JARGONIZE22BT.PW
Registry Domain ID: D50651876-CNIC
Registrar WHOIS Server: whois.PublicDomainRegistry.com
Registrar URL:
Updated Date: 2017-07-28T10:28:00.0Z
Creation Date: 2017-07-28T10:28:00.0Z

Both sites are resisted to one ¨James Carter¨, who works for ¨Friendly Advice¨.

In case you cannot read German, the text reads the following (I ran an online OCR in German to get the text, then passed it to google translate):

The page on 'eu.unitize370vu.pw' says:
Congratulations!

Google users! They were selected as winners of today's FREE iPhone 7, PlayStation 4 or Samsung Galaxy's S6!

Please click OK to claim your price before we give it to someone else!

You only have 1 minute and 30 seconds to answer the 3 following questions before the prizes are awarded to another happy visitor! Good luck!

While being on this site will not harm any device, it can track your IP address, which can be used to find your information, including your ISP, (full) name and even address. To avoid this happening to you, never click on a link on Facebook, but rather search the title on Google and verify that the URL is a legitimate one, like www.huffingtonpost.com.

  • Can you remove this line, please? "Apps on the Google Play Store are reviewed by teams of specialists, so theoretically you cannot get malware from there. " Here's why. – Mark Buffalo Sep 1 '17 at 18:53
  • Also, what do you mean, "While being on this site will not harm any device"? How can you tell? Did you check for browser hooks such as BeEF, etc? I'm downvoting you until the content of this post improves. – Mark Buffalo Sep 1 '17 at 18:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.