Virus scam appearing only when on Mumsnet

[Puzzledandpissedoff]

Just wondering if anyone else has had this?
As in the title I'm getting frequent "warnings", supposedly from McAfee, claiming I've got various viruses and inviting me to click a link (not done of course)

I don't use McAfee anyway and they're not from them - their site has images of a common scam which matches these - but it only happens when I'm clicked onto Mumsnet

Anyone know what's happening by any chance?

Is that what they said?!

Not at all, @IwantToRetire; their statement was on the "Huge adverts making site unusable" thread, yesterday at 11:40, and it dealt with the need for advertising revenue and gave some interesting info on what they're doing to combat the intrusions

It was me who fully appreciated their need for the revenue, but was asking how scam sites came to be involved too

It was me who fully appreciated their need for the revenue, but was asking how scam sites came to be involved too

Thanks, I misunderstood.

But thanks for asking that question.

I don't know about MN's tech support, but it just seems reallly strange that this keeps happening on their web site.

For both work and personal reasons I spend what seems like most of my waking hours on various web sites, many dependent on advertising, and have never experience this.

I've just had it again on the "To just give them what they want" thread. I'm on my HP laptop on Chrome.

If you are having these problems with MN, check which sites are allowed. On Chrome it is the bit to the left of the site address.
If you have six or more "on cookies and site data" things, clean up your browsing data.

Use the three dots at the right of your address bar, go to settings and have a nose around to find out how to clean up and limit stuff.

Ask a techy friend for help if necessary.

Place-marking in case I get this again. (Chrome browser, Windows 11). I deleted cookies from the previous hour. Then did it gain. Will report back if it recurs.

Yes - but the issue is why is this happening on MN? Not how to get round it!

Its really very strange. In fact I would be interested in an explanation as to how MN seems to have become a launch pad for so many scam websites.

When other web sites dont cause these intrustions on users' individual devices.

From the whois registration on mumsnet https://www.whois.com/whois/mumsnet.com it seems to be hosted on cloudflare (?) but whoever it is might also be able to advise.

Never noticed that bit left of the address before @NerdWhoEatsMedlar

In settings it lists "Intrusive ads - Block if site shows intrusive or misleading ads" and that's blocked by default so I'd have thought that would sort it?
However it also lists "Third party sign in" and that's on by default - is that significant?

As you'll very quickly realise I'm hopeless with this stuff, but I'll gladly do anything I can to help myself

I've been getting this too, seemingly randomly, not on any particular thread and not dependent on whether I've posted anything.
It's been happening for the last couple of weeks but today I had it pop up twice.

I never click on anything, but today the thing said it was running a scan, so it made me a bit anxious. It wouldn't close so I ended up shutting my laptop down.

I'm not good with technology so no idea how to get rid of it.

It definitely appeared on both my laptops, only one is running Adblocker (or similar), the other isn't, but it still appeared!

Just had it again, it says "scan in progress" .

I'm on chrome, old Dell laptop.

Thanks for the recommendation, @DogInATent - surprised it's still there TBH - I installed it when for whatever reason the scam ad wouldn't be deleted and seemed to be uploading (?) something

I don't mind in the least having normal ads once HQ sort this out and will of course remove the programme then; it's only fair after all, but I can't risk my systems getting trashed and ending up with a big bill to get it fixed

It's happened to me too several times over the last few weeks on a Lenovo laptop with Chrome. The extra popup saying "scan in progress" is new, only appeared in the last couple of days. Maybe they're hoping we'll click "OK" to make it go away. I usually kill it by closing the browser tab, sometimes I have to shut down Chrome altogether with the Task Manager.

I've been getting this, and having issues with Chrome on Mumsnet. After I've scrolled a few pages, Chrome just freezes. Only ever on MN. I have deleted some of the cookies to the left of the address, as per previous poster's advice.

https://9r3np2doxt.online/?5jfgg3=U2FsdGVkX1%2Bu1YCgWPlqfFI874T%2BnL1ycTxpKHr8f0FeBcMnSE36C2ruc6SfTSnas7KuG3aeT5c6sgbOitc%2BoG004RekapFPVpu2%2BkTun57OR6a7JljjjwUBgX9kXufhiHeV16mY%2BesMPxNMj4Fvt348AF176ojuFPJlt3HNnR6pwRHs7X6fTdEwvmC06qUKgGKdZmmXTIwGoTDnQNQO7QaB0HLHP7U%2FeAJx3VnkMiOFt%2FGz7LHiR4xcXbt4r9cG

And it is still here....

What I dont understand is what exactly these scammers are after.

Each time I have a hijack I use https://who.is/ to find out where they are hosted, and also how long they have had a registered web address.

Many seem to have only been registered in the last week at most.

So either there are just hundreds of them doing this, or a small group who spend all their time created new domain names, setting up a web site, and once on the banned list just move.

They want you to click on a link and authorise them to install something on your computer.

It's happening again, this time on this thread https://www.mumsnet.com/talk/am_i_being_unreasonable/5227057-to-think-this-dad-took-it-too-far

I've had this appear twice today but not on the thread mentioned above. Once was on a dog related thread, the other on a trending thread about weight.

I get loads of blocked website warnings only when I am on Mumsnet too. Safari.

This same scam is happening again.

And again they have registered a new web address (p1gq0izj dot shop), so at this point in time it isn't on any block web address lists. Worse still they have been allowed to register a new web address and used the option not to disclose who has registered it. Its high time that this was more regulated.

But I still dont understand what they gain from this.

If you have your own anti virus software no one would accept a random instruction from an unknown source telling you what to do.

And if you dont have any anti virus software installed, why would you think being told a virus scan was happening was valid.

Well maybe one in a million does.

But none of this explains why it only happens on mumsnet.

@IwantToRetire I only have this on Mumsnet too. There's another thread about the nasty Etsy ads, although I don't seem to be getting these lately. I don't know much about paid ads, but I suspect It's either how the ad integrations are set up, or the company supplying them?

I find it very confusing.

mumsnet web site is either maintained in house by suitabley qualified people or by an outside expert group.

So I assume the wording, images and web links for an ad are posted by those who maintain the web site.

It isn't like advertisers randomly add ads in the same we as we can add posts or even start a thread. You would think this aspect of the web site would be more vulnerable. Not the bits on the web site that are maintained and updated by IT professionals.

@IwantToRetire I think the site will just determine where and how frequently ads pop-up/are displayed and select a "group" of advert types from a company who supply the ads. I would assume things like gambling, alcohol, nudity etc can be easily opted out from, but I can't help feeling some of the companies supplying the ads aren't being careful enough and some dodgy companies are slipping through...

Two weeks with none, and back again last night while scrolling through Last Hour. Just appeared again within 20 seconds of logging into Mumsnet. Not on any of the previous sites I've been on in the last hour. Edge on laptop.