Links to other peoples' mods redirecting to ad and phishing sites

[iorveth1271]

Was following the links to "Recommended/Used mods" on the mod page "Now That's What I Call Stubble" by cherrycioccolata (https://www.nexusmods.com/cyberpunk2077/mods/1276) and they all keep redirecting me to phishing and ad sites, mostly of the pornographic kind.

 

Using Windows Defender, full system scan detected nothing unusual.

 

First visited on Jan 27th 2021 at 00:22 am CET.

 

Mod page from which the falsely redirecting links are occurring was https://www.nexusmods.com/cyberpunk2077/mods/1276 (see above - all links in the Recommended/Used mods section in the mod description)

 

Living near Leipzig, Germany.

 

Reason why I strongly believe it's a bad/malicious ad is that the URL on the mod links in the "Recommended/Used mods" section ARE legit, as in, it does try to connect to them, but then actively redirects to ad and phishing sites before loading the nexus page for said recommended or used mod. The sites to which I got redirected also appear in my browser history, so I wasn't just dreaming that stuff either. Came here to see if that was a known thing first-off after it occurred and it sounds like that's not an isolated incident so here we are.

 

The URL(s) to which I got redirected are as follows:

 

http://alfik-fik.com/zcvisitor/4ca6d9a4-602d-11eb-9010-12f6cad9c1d7/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=4cbe322b-602d-11eb-9010-12f6cad9c1d7

http://alfik-fik.com/zcredirect?visitid=4ca6d9a4-602d-11eb-9010-12f6cad9c1d7&type=js&browserWidth=1920&browserHeight=938&iframeDetected=false

http://www.https.com//www.nexusmods.com/cyberpunk2077/mods/1045

(note how it inserted a www.https.com before the actual, intended URL)

http://alfik-fik.com/zcvisitor/4fd27700-602d-11eb-a928-0a350c8c687d/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=2a12d8c0-ddec-11ea-90ed-12e5dcaa70ed

http://alfik-fik.com/zcredirect?visitid=4fd27700-602d-11eb-a928-0a350c8c687d&type=js&browserWidth=1920&browserHeight=938&iframeDetected=false

And then the actual websites it directs to:
https://adultbaron.com/nlp/index.php?subPublisher=205.0&clicktag=1e33ax946scbgvr8fd&server=1&url_bnm_redirect=https://o-2548.cippher.com/1143b5a1-0e4a-4faa-ad4e-6e4eb70a7795

https://bl.flirthits.com/landing/cm2001?clickId=7df7dcc5-aaf4-440f-987c-ecb60aa9de49&tracker=SGM_Pro&publisher=2819&subPublisher=205.0&zz=true&hit_id=7df7dcc5-aaf4-440f-987c-ecb60aa9de49&tp_redirect_id=7df7dcc5-aaf4-440f-987c-ecb60aa9de49

And then the redirect attempts that my anti-ad plugin apparently swiftly shut down and closed the tab before it could load:
http://alfik-fik.com/zcvisitor/58a33d68-602d-11eb-9791-120f043ede13/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=58b9f9bc-602d-11eb-9791-120f043ede13

http://alfik-fik.com/zcredirect?visitid=58a33d68-602d-11eb-9791-120f043ede13&type=js&browserWidth=1920&browserHeight=938&iframeDetected=false

Unfortunately, I cannot provide a screenshot of the bad ad as the first time, I clicked it away immediately to avoid potential malware infection and the second time it got caught outright by ad protection and auto-closed as mentioned above. Thus, best I can do is the attached screenshot of uBlock Origin catching the third/trial attempt to get said screenshot for y'all.

[HadToRegister]

Was following the links to "Recommended/Used mods" on the mod page "Now That's What I Call Stubble" by cherrycioccolata (https://www.nexusmods.com/cyberpunk2077/mods/1276) and they all keep redirecting me to phishing and ad sites, mostly of the pornographic kind.

 

Using Windows Defender, full system scan detected nothing unusual.

 

First visited on Jan 27th 2021 at 00:22 am CET.

 

Mod page from which the falsely redirecting links are occurring was https://www.nexusmods.com/cyberpunk2077/mods/1276 (see above - all links in the Recommended/Used mods section in the mod description)

 

Living near Leipzig, Germany.

 

Reason why I strongly believe it's a bad/malicious ad is that the URL on the mod links in the "Recommended/Used mods" section ARE legit, as in, it does try to connect to them, but then actively redirects to ad and phishing sites before loading the nexus page for said recommended or used mod. The sites to which I got redirected also appear in my browser history, so I wasn't just dreaming that stuff either. Came here to see if that was a known thing first-off after it occurred and it sounds like that's not an isolated incident so here we are.

 

 

 

Unless this has already been fixed...

 

I clicked on the Recommended links on the mod page and went straight to the other mod pages.

 

I think you had better check/scan your system again, it might be a browser extension that's hijacking you.

[iorveth1271]

Unless this has already been fixed...

 

I clicked on the Recommended links on the mod page and went straight to the other mod pages.

 

Seems it's fixed for me as well now. Who knows what that was, then. Scan came up clean once again and only have uBlock Origin and ABP on my browser so fairly sure it's not them since they're what caught the issue in the first place.