automatic redirection to scam site, detects user ISP to look more legitimate.

[Slyther987]

Hi I’m writing to inform you of a re-direct that is happening on your website without the user clicking on any advertisements.

 

I’ve had this happen to me thrice and am in the process of testing if it is your website or not. However I have also been in contact with the discord modding community to confirm if it is Site side or PC side.

 

I am also performing an anti virus and tests to see if the re-directs happen on other sites, so far they do not. Here is how the re-direct happened for me.

 

I have a pin open with this link

 

https://www.nexusmods.com/subnautica/mods/?BH=17

 

every day around the same time I choose to filter it for “latest update” however today whenever I do this I get taken to a website with my ISP logo in the top left hand corner saying I have won something, I already contacted sky and they have stated that they don’t do that.

 

so it is a phishing attack.

 

In my browser history I have the following 2 links.

eu.jktouristattractions.xyz

eu.jbayattractions.xyz

 

chrome lists them as sky. However they are not.

 

To clarify I have also checked my lottery numbers, updated my youtube subs, checked a facebook page and for this time the re-direct only happened when I performed the specific action listed above on https://www.nexusmods.com/subnautica/mods/?BH=17 when ordering by “latest updated”. also since it happened yesterday it did not happen again when browsing other sites and while studying an online course. also did not happen while browsing steam.

 

As stated I wanted to check if anyone else has this issue and on the subnautica modding discord I was informed it could be a bad/malicious advertisement.

 

also i have scanned with both Malwarebytes and zone alarm. both clean.