According to the IT managers, this problem is neither at the server nor at the client but is suspected to be somewhere inbetween e.g. some DNS server that has been infected. Do you recognize this situation: A user browses the web to a homepage and gets spam links at webpages that don't actually send these links, and it appears at network locations rather than spec clients (if the client changes the network then the spam goes away).
What is the name of this breach that inserts spam links to webpages and how can it be traced and resolved? What traffic should be sniffed to locate the source?