Forum Thread

Strange pop ups

ns723 277 48 February 26, 2016 at 02:29 PM
Lately when browsing slickdeals I'm getting occasional (2 so far) your flash needs updating pop up tabs wanting to download a binary file. I clicked https://slickdeals.net/f/8528675-samsung-64gb-usb-3-0-flash-drive-duo-17-99-free-shipping-cheaper-than-previous-frontpage-deal?page=3#commentsBox and got (copied from address bar) https://eeyeijoel.com/94111568434...d90b4.html

A few days ago I clicked another deal and got the same popup with url https://xieghxopso.com/2432890474...89862.html

This only happens at slickdeals so I think it's something here and not on my computer.

46 Comments

1 2 3 4

Sign up for a Slickdeals account to remove this ad.

#2
Quote from ns723 View Post :
Lately when browsing slickdeals I'm getting occasional (2 so far) your flash needs updating pop up tabs wanting to download a binary file. I clicked https://slickdeals.net/f/8528675-samsung-64gb-usb-3-0-flash-drive-duo-17-99-free-shipping-cheaper-than-previous-frontpage-deal?page=3#commentsBox and got (copied from address bar) https://eeyeijoel.com/94111568434...d90b4.html [eeyeijoel.com]

A few days ago I clicked another deal and got the same popup with url https://xieghxopso.com/2432890474...89862.html [xieghxopso.com]

This only happens at slickdeals so I think it's something here and not on my computer.
Thanks for letting us know. I'm looking into it now and hope to have these guys banned before the weekend.
Reply Helpful Comment? 1 0
Joined Jun 2014
L3: Novice
277 Posts
48 Reputation
Original Poster
#3
Thanks. I just saw it again so I took a screenshot this time. First I clicked the deal link at https://slickdeals.net/f/8528675-samsung-64gb-usb-3-0-flash-drive-duo-17-99-free-shipping-cheaper-than-previous-frontpage-deal?src=featured-7261

and that sent me from slickdeals to https://eeyeijoel.com/68228904742...48583.html

Plus I got the usual Amazon product pop up tab with the small FlashPlayer.exe download window on top (I switched back to the eeyeijoel.com tab for the screenshot to get both in the same image).
Reply Helpful Comment? 0 0
#4
This same popup virus happened to me 2 times. The last time was tonight around 11:00 pm central time. I was viewing:

https://slickdeals.net/f/8526231-galaxy-note-4-t-mobile-280-manufacturer-refurbished?page=8#commentsBox

The popup address was:
https://eeyeijoel.com/25712019830...b3446.html

Also, I only see this virus attempt when on slickdeals.net
Reply Helpful Comment? 0 0
Joined Jul 2005
Toadally Irrelephant
7,722 Posts
1,227 Reputation
#5
Thanks to Doublewood and the rest of the SlickDeals staff who shut these scumbags down!!
Reply Helpful Comment? 1 0
Last edited by VorlonFrog February 27, 2016 at 10:57 AM.
#6
Quote from VorlonFrog View Post :
Thanks to Doublewood and the rest of the SlickDeals staff who shut these scumbags down!!
Who should I talk to. Same thing just happened to me.

Same thing just happened to me. Who do I contact? I was referred to this forum.
Reply Helpful Comment? 0 0
Last edited by yoosedog February 28, 2016 at 07:04 PM. Reason: Automerged Doublepost
Joined Jul 2005
Toadally Irrelephant
7,722 Posts
1,227 Reputation
#7
Quote from yoosedog View Post :
Who should I talk to. Same thing just happened to me.

Same thing just happened to me. Who do I contact? I was referred to this forum.
Post the details here in this thread and Doublewood or some other staff member should be around to read it and comment.
Reply Helpful Comment? 0 0
Joined Jun 2014
L3: Novice
277 Posts
48 Reputation
Original Poster
#8
I just saw this again. This time just after I went to slickdeals.net and didn't click anything it sent me to https://seefed3db.biz/18028904742...69cf2.html

Just fyi if it helps.
Reply Helpful Comment? 0 0

Sign up for a Slickdeals account to remove this ad.

#9
Quote from NoMoneyHoney View Post :
This same popup virus happened to me 2 times. The last time was tonight around 11:00 pm central time. I was viewing:

https://slickdeals.net/f/8526231-galaxy-note-4-t-mobile-280-manufacturer-refurbished?page=8#commentsBox

The popup address was:
https://eeyeijoel.com/25712019830...b3446.html [eeyeijoel.com]

Also, I only see this virus attempt when on slickdeals.net
Quote from ns723 View Post :
I just saw this again. This time just after I went to slickdeals.net and didn't click anything it sent me to https://seefed3db.biz/18028904742...69cf2.html [seefed3db.biz]

Just fyi if it helps.
Hey guys, we're going to shut down some ad partners since this is still happening. Please let us know if you continue to see it. These kind of fake ads have no place here or anywhere else.
Reply Helpful Comment? 1 0
Joined Jun 2014
L3: Novice
277 Posts
48 Reputation
Original Poster
#10
Agree and they are also hijacking my browser and taking me off slickdeals to their fake urls. I didn't see it yesterday so I thought it was gone but I just saw it again just after going to slickdeals.net and clicking this front page deal https://slickdeals.net/f/8535875-cyberpower-avr-cp825avrg-825va-ups-55-newegg-4am-pt
It sent me to https://chahgsky-animes.com/73628...2d04b.html
Reply Helpful Comment? 0 0
Joined Jun 2014
L3: Novice
277 Posts
48 Reputation
Original Poster
#11
I haven't seen this since just after 3/2 so I thought it was gone for good but I just saw it again https://ebaegmarymaxim.com/542289...1077c.html
Reply Helpful Comment? 0 0
#12
Quote from ns723 View Post :
I haven't seen this since just after 3/2 so I thought it was gone for good but I just saw it again https://ebaegmarymaxim.com/542289...1077c.html [ebaegmarymaxim.com]
Thanks, we just blocked this URL.
Reply Helpful Comment? 0 0
#13
I'm still seeing redirects for bogus flash updates and other crap, but only when going to slickdeals. also popup ads for "Support PC" "Ad by Advertise". just started early this afternoon.
Reply Helpful Comment? 0 0
Joined Jun 2014
L3: Novice
277 Posts
48 Reputation
Original Poster
#14
Just got another https://ofietallposters.org/27728...ddb57.html

They seem to be random or changing URLs since I see a different one every time.
Reply Helpful Comment? 0 0
#15
I'm using Firefox with Flash disabled and I've been seeing these redirects happen about every other day. The latest one redirected me to the domain ofietallposters.org. What all these domains have in common is their registration information. Perhaps Slickdeals should block advertising sites based on domain WHOIS info.

Results from https://whois.icann.org/en/lookup...osters.org

Domain Name: OFIETALLPOSTERS.ORG
Domain ID: D187087931-LROR
WHOIS Server:
Referral URL: http://www.PublicDomainRegistry.com
Updated Date: 2016-03-17T15:40:06Z
Creation Date: 2016-03-17T15:40:06Z
Registry Expiry Date: 2017-03-17T15:40:06Z
Sponsoring Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com
Sponsoring Registrar IANA ID: 303
Domain Status: clientTransferProhibited https://www.icann.org/epp#clientT...Prohibited
Domain Status: serverTransferProhibited https://www.icann.org/epp#serverT...Prohibited
Domain Status: addPeriod https://www.icann.org/epp#addPeriod
Registrant ID: DI_30235405
Registrant Name: Monty
Registrant Organization: NA
Registrant Street: Grim Avenue
Registrant City: San Diego
Registrant State/Province: California
Registrant Postal Code: 92103
Registrant Country: US
Registrant Phone: +1.6198213784
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: monty.ratliff@yandex.com
Admin ID: DI_30235405
Admin Name: Monty
Admin Organization: NA
Admin Street: Grim Avenue
Admin City: San Diego
Admin State/Province: California
Admin Postal Code: 92103
Admin Country: US
Admin Phone: +1.6198213784
Admin Phone Ext:
Admin Fax:
Admin Fax Ext:
Admin Email: monty.ratliff@yandex.com
Tech ID: DI_30235405
Tech Name: Monty
Tech Organization: NA
Tech Street: Grim Avenue
Tech City: San Diego
Tech State/Province: California
Tech Postal Code: 92103
Tech Country: US
Tech Phone: +1.6198213784
Tech Phone Ext:
Tech Fax:
Tech Fax Ext:
Tech Email: monty.ratliff@yandex.com
Name Server: NS1.EUROPEDNS.NET
Name Server: NS2.EUROPEDNS.NET
DNSSEC: unsigned
Reply Helpful Comment? 0 0
Page 1 of 4
1 2 3 4
Join the Conversation
Add a Comment
 
Copyright 1999 - 2016. Slickdeals, LLC. All Rights Reserved. Copyright / Infringement Policy  •  Privacy Policy  •  Terms of Service  •  Acceptable Use Policy (Rules)  •  Interest-Based Ads
Link Copied to Clipboard