Active discussions

Please or to access all these features

Talk
Site stuff

Join our Innovation Panel to try new features early and help make Mumsnet better.

See all MNHQ comments on this thread

Original poster

Fake virus page taking over

143 replies

WingsofRain · 07/07/2025 08:56

Twice in the past twelve hours I’ve had a fake virus page appear and take over my screen while reading posts on Mumsnet. Each time it was on AIBU, but different posts.
The only way to get out of it is to close the tab.

It looks very much like a hijack or man-in-the-middle attack.

Fake virus page taking over
OP posts:
Thread gallery
13
MNHQ
JoMumsnet · 11/07/2025 13:19

Thanks, Chemenger

C8H10N4O2 · 11/07/2025 11:53

JoMumsnet · 11/07/2025 11:05

Hi everyone,

Thanks for bearing with - we understand how frustrating this must be.

We're still working on a more permanent solution but for now we're manually blocking these domains. We've blocked all of the domains that have been shared on this thread so far, but if anyone can grab the URL for the McAfee one or any other new ones that are popping up, that would be a huge help.

Thank you - and again, we're so sorry for all the disruption these ads are causing.

You will never stop playing whackamole by blocking domains - presumably this is just the operational band aid whilst the source is identified?

Is this piggy backing on your advertising framework again?

summertimeinLondon · 11/07/2025 11:42

8misskitty8 · 07/07/2025 09:03

I’ve just had this as well. On AIBU and also on notifications tab.

Using site on an iPhone via the website.

Edited

I’m having this too this morning. Also on iPhone on MN website.

AnneKipankitoo · 11/07/2025 11:32

I have just had this too. Started a thread.

FlamingoFloss · 11/07/2025 11:07

Liathnait · 11/07/2025 10:57

I also get those

Show quote history

Me too

FlamingoFloss · 11/07/2025 11:07

Yes, this happened to me yesterday too

MNHQ
JoMumsnet · 11/07/2025 11:05

Hi everyone,

Thanks for bearing with - we understand how frustrating this must be.

We're still working on a more permanent solution but for now we're manually blocking these domains. We've blocked all of the domains that have been shared on this thread so far, but if anyone can grab the URL for the McAfee one or any other new ones that are popping up, that would be a huge help.

Thank you - and again, we're so sorry for all the disruption these ads are causing.

Liathnait · 11/07/2025 10:57

Motherfluffers · 11/07/2025 08:58

Another new thing since this started- I’m getting constant page refreshes and these wipe a half written post every time that happens.

I also get those

TourdeFrance2025 · 11/07/2025 10:38

And again on the 'why haven't my new neighbours moved in yet' thread

Motherfluffers · 11/07/2025 08:58

Another new thing since this started- I’m getting constant page refreshes and these wipe a half written post every time that happens.

TourdeFrance2025 · 11/07/2025 08:53

@JoMumsnet

but as you directed people here from the old thread, you know this has been going on for over a year now (probably not continuously).

it's not the small site it was 20 years ago, it's a huge commercial enterprise & needs to invest.

EDIT: I actually came back to the thread to report it's still happening. I phone/safari. I was actually in the Active page, not a thread, this time.

Liathnait · 10/07/2025 13:57

I’ve just had the McAfee one again.

MNHQ
JoMumsnet · 10/07/2025 12:29

Thanks, @WingsofRain and everyone else who's posted (or sent us) screenshots and URLs. We'll be back with an update just as soon as we can.

Original poster
WingsofRain · 10/07/2025 11:06

I’ve just had it again, while looking at this thread. Same fake McAfee thing, but a different URL this time.

https://shieldnest.cfd/avs/en/mob/global-bb.php?c=1mz1139baz7oz0&k=3ac5c27c6aad018ba121595de32b6525&country_code=GB&carrier=BT&country_name=United%20Kingdom&region=Dumfries%20and%20Galloway&city=Annan&isp=British%20Telecommunications%20PLC&lang=en&os=iOS&osv=18&browser=Safari&browserv=&brand=Apple&model=iPhone&marketing_name=iPhone&tablet=2&rheight=0&rwidth=0&e=5

https://shieldnest.cfd/avs/en/mob/global-bb.php?brand=Apple&browser=Safari&browserv=&c=1mz1139baz7oz0&carrier=BT&city=Annan&country_code=GB&country_name=United+Kingdom&e=5&isp=British+Telecommunications+PLC&k=3ac5c27c6aad018ba121595de32b6525&lang=en&marketing_name=iPhone&model=iPhone&os=iOS&osv=18&region=Dumfries+and+Galloway&rheight=0&rwidth=0&tablet=2

OP posts:
Motherfluffers · 10/07/2025 10:58

I changed my password to MN and so far it hasn’t happened again this morning but that might just be coincidence.

PerkingFaintly · 10/07/2025 10:47

I have my laptop set up to Show Status Bar when I hover on a link, but this spam page shows nothing anywhere.

PerkingFaintly · 10/07/2025 10:42

Just happened again this moment. Same message, different URL (Megadraws). I'll report this post and include the URL.

PerkingFaintly · 10/07/2025 08:41

I reported my post and sent you the URL.

AndWhoShallISayIsCalling · 10/07/2025 08:38

Just had this as well. Probably the 3rd/4th time it's happened this week.

Fake McAffee. I'm on iPhone accessing MN via Safari.

Not clicking on anything on the page just reading a thread and it starts.

Helleofabore · 10/07/2025 08:34

And like magic it happened again @HebeMumsnet @JoMumsnet as I was reading a thread about Owen Jones and trying to work our just what JKR did again.

Helleofabore · 10/07/2025 08:28

GCAcademic · 10/07/2025 01:20

I had this twice today. URL was megadraws.click and telling me as a Google user that I had won an iPhone or Samsung Galaxy

Sounds like they are widening their scope.

PerkingFaintly · 10/07/2025 08:28

Oh I'm glad to find this thread. I had this one (fake Vodafone offer) on 7 July, and it repeated throughout the day. I don't think I've seen it since, so maybe you've nabbed this one.

I'm using Safari 18.5 on a MacBook Air. I'll PM you the URL as it appears in my History.

It happened on a variety of threads, and I hadn't clicked anything.

Fake virus page taking over