We currently have a specific situation on our website. We are a portal which serves ads, mostly via google network.

Some of our users have started to complain that they are experiencing popups and redirects. Popup is mostly related to some jackpots or free amazon 1000$ gift cart.

I have tried to fake geolocaion and IP address myself, but i never had any problems with it.

A lot of users which report this activity, states that they only have issues on our domain.

This issue only happens to users out of our country. What are the best ways to analyze problems like this. This sounds like some malware or faulty ad campaign, but I must be sure, and I can't reproduce issue to trace it.

enter image description here enter image description here

  • I googled "you've been randomly selected to get (3) free spins" and got pointed to this page. It says that it's adware on the client machines, not your server. – Neil Smithline Apr 20 '18 at 1:13
  • @NeilSmithline I've googled that myself, but that not seems to be issue. It happens only on mobile phones on pages where we have google ads. Users who happen to have this issue, do not experience on pages where we do not have ad slots. Also, if it is adware, it would attack other websites, not just ours, right? – Robert Apr 20 '18 at 5:22

We had the same issue some time ago. This probably comes from ads from Google AdSense. Unfortunately Google AdSense if full of malicious ads targeted only for mobile devices and debugging this is nearly impossible.

After months of searching and disabling some 3rd-party networks in AdSense panel, we added device detection on server side based on user agent. Now we're serving ads from AdSense for desktops and custom ads for mobiles - problem disappeared (or at least no one bothers to report it to us).


First of all, check that your users are using HTTPS. There were many situations in the past, where ISPs and other similar entities or even local software added additional advertisements to websites.

If that does not help, you may want to check something like Content-Security-Policy header, to block any scripts that do not belong on your sites. Though I am not sure how that works with google advertisement.


In the end, problem was in faulty and malicious advertiser trough one of our header bidding partners.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.