[SOLVED] Redirect to phising/scam website

[Scouter456]

Recently I have been having some problems with normal url websites getting redirected to other websites. These websites "say" they are from my internet provider that I won xxx, I would like to know what caused this (malicious ads, viruses, compromised dns), and how to fix this. It also happened on my phone. I have added a picture with the url links, but they seem to change everytime I get the redirect,

https://imgur.com/a/2YA6NpQ

View: https://imgur.com/a/2YA6NpQ
.

On my pc I am using Windows 10
On my phone I am using Android

 

[rgd1101]

using wifi/modem/router?
what dns server are you using?

 

[Alabalcho]

If you go with your phone to public WiFi - do you still see these URLs?

 

[Scouter456]

I am using a modem-router with a wired connection. I am using the standard DNS server from the provider, which are, 89.101.251.229, 89.101.251.228

 

[Math Geek]

echoing the big question asked here.

does your phone do the redirect when on cell data or public wifi?? or just when connected to your home router??

 

[Scouter456]

I am using wifi from home router, not cell data or public wifi

 

[Alabalcho]

I am using wifi from home router, not cell data or public wifi

Again - if you connect to a public WiFi, or thru your cell data - wha t do you see?

 

[Scouter456]

I don't have any public wifi closeby nor do I have cell data, so I can't check right now. And it isn't a consistent redirect it happens once in a while.

 

[Math Geek]

try turning off the wifi and let the cell data handle the internet for you. does it still do the redirect?

this is an important question as it helps narrow down where the problem is.

 

[Scouter456]

I do not have cell data.

 

[Math Geek]

ok, no biggie, can you get to some public wifi and check there? i know right now a lot of stuff is closed down but with so many places offering it, thee should be some free wifi you can use for a few minutes. even sitting outside the local mcdonalds would let you use theirs for a few.

we're basically trying to see if your router itself has been infected or your devices themselves. need to know this before knowing where to go from here.

 

[rgd1101]

try using google dns.
like the other said, test the android on another location.
could be your modem/router got hacked.

 

[Math Geek]

yah google dns is a good idea as well. good call

 

[Scouter456]

Right, I can use some other wifi, but I don't know if it will happen because when on my normal router it also didn't happen every time.

 

[Scouter456]

Righ, so I turned off my adblocker and the redirect immediately happened. So I think it is caused by some sort of ad. It could also have been pure coincidence but I will check some more. I also changed my DNS to google one before that.

 

[Ralston18]

And I suggest that you check the hosts file.

https://www.lifewire.com/how-to-edit-the-hosts-file-153661

 

[Scouter456]

There is nothing in the hosts file

https://imgur.com/a/Q76QPPl

View: https://imgur.com/a/Q76QPPl

 

[rgd1101]

malware scan your pc?
Does it only happened on some site that you go to?

 

[Scouter456]

Using the free version of Malwarebytes, no threats detected.

 

[Ralston18]

In Windows 10 use Task Manager and Resource Monitor to search for some unknown/unidentifiable or even unexpected application running in the background.

May launch via Task Manager's startup tab or even via Task Scheduler. Look there as well.

If you find anything suspicious then google accordingly and/or post.

 

[Scouter456]

I don't see anything suspicious, at least to my knowledge. I think it might be some sort of ad causing it, I haven't had it happen anymore since changing my adblocker. Will post if it happens again with adblocker on.