Virus scam appearing only when on Mumsnet

[Puzzledandpissedoff]

Just wondering if anyone else has had this?
As in the title I'm getting frequent "warnings", supposedly from McAfee, claiming I've got various viruses and inviting me to click a link (not done of course)

I don't use McAfee anyway and they're not from them - their site has images of a common scam which matches these - but it only happens when I'm clicked onto Mumsnet

Anyone know what's happening by any chance?

I was trying not to name a specific one and said "an adblocker" out of respect for MN as it will impact their revenue if too many users go this route. But after they proved not to be interested in finding a solution to protect users I did then name the one that was effective. Other PPs have reported adblockers that haven't worked for them, but those that have gone with the one I named have reported no further occurrence of the pop-up since then.

I can't believe this has been an ongoing user security problem for 2 months and MN are still stalling with the "provide details" response.

Same here - I'm on Microsoft Edge on my laptop. It's happened about five times now - the warning flashes up and replaces the MN page.

I think site problems should be fixed at the site, not by users finding ways to manage an unsolved problem.

Exactly.

I find this really strange on a well known UK web site, presumably maintained by experts that this is happening.

And if as a PP suggested it is to do with so external source that provides ads on a rotating basis, they should have their contract terminated, and some other source of ad revenue found.

I find this really strange on a well known UK web site, presumably maintained by experts that this is happening

Is it "maintained by experts" though, @IwantToRetire? I genuinely don't know, and as for fixing problems, I wonder how much of a problem HQ perceive this to be as long as enough continue to use the site

Then again I'm always a bit befuddled that so many seem to regard this mainly as some sort of help agency, when actually it's a business and will (perfectly naturally) put the business first

Then again I'm always a bit befuddled that so many seem to regard this mainly as some sort of help agency, when actually it's a business and will (perfectly naturally) put the business first

Nobody is "befuddled".

It is exactly because it is a business that questions are being asked.

And worth commenting on given how many "businesses" run online forums without these hiccups.

Do you think we shouldn't let them know they have a problem?

Do you think we shouldn't let them know they have a problem?

Of course not, @IwantToRetire, and I didn't mean to suggest that at all

You're quite correct that a business should expect these questions to be asked but still I maintain that, if enough people continue to use the site, HQ may not see this as quite the problem a selection of users do

hmmm........... maybe we should leak the story to the Daily Mail or something!

same virus fake message

This time the web site it originates from is pcsy3hx1 dot online/

Again newsly registered, and again the usual domain holder contact details have been with held.

So this could basically the same individual I found via a company search setting up a new web site every day, which means the web address will not for at least 24 hours be on any of the spam blocker lists.

None of these dot shop urls take you to an actual web site.

So despite being confused by why this only happens on mumsnet, I do think those that regulate domain registration should be more diligent in finding out if someone has a history of setting up sourse of spam.

@IwantToRetire we we talking about who actually handles the ad placement, and if it helps I found the post below from HQ on one of the other many threads about the issues
I know you're much better aat understanding these than me (TBH anyone is!!) but just wondered if it might help ...

^"We're currently working with an ad verification company that proactively blocks the majority of these issues, but there are still cases (like these) where they slip through certain routes and have an impact on user experience. When that happens, we reactively block ads based on URLs/advertiser name.
The manual process of finding the culprit and implementing blocks can be lengthy as we do not have a direct relationship with these advertisers. This is exacerbated due to having a small team that deals with this. However, we are looking at options to help speed up this process, change the setup and are hiring help to navigate these issues more effectively"^

@BeckyAMumsnet Just got another divert to https://pcsy3hx1.online/?r8uf3cf=U2FsdGVkX18ZdsQL2amEo3%2FqgwHlZam%2BkGDDRKYHHncsRDSIefCo22mzXDcMb09eAyR76FFXYBdE8ixLJN5Usf9qg2EzJMfjawN3dozTAqQLzZjFzVsT0CsoJzzyoLO3fQQ4mC0iFfCpxI294%2BTvto4DLWuz6R42Gu85BG2o8K0uJGpwUG0vhZzYDmZ1E6HokXTZLScgURk%2Bml407fP4aNqjKQ5o5qpoJCSsGLu52jBGEbAsGEzQwuLM9J6Xl93kbmuQW9GEQUoDxUK69tW%2BiQ%3D%3D

There's a McAffee "your subscription has expired" sort of warning on the page.

I have been deleting the past hour of browser data to try to respond to it, but it is unnerving.

Same again, on my notifications page, popped up literally 5 seconds after I opened a mumsnet tab. Laptop, chrome, no adblocker.

Thanks - that's interesting.

Although not reassuring.

But support what I was thinking, that even a lone individual can set up endless domain names .shop being a favourite at the moment, and can immediately start spamming.

Although it didn't take me long to got back throught whois information to potentially find who was doing this.

And as all these domain names seem to be registered through the same company I dont see why they cant be alerted to that fact that they are enabling this.

But I have no grasp of how the internet is actually governed if at all!

Chrome browser in incognito mode (thought it might help - but no).

I'm suddenly getting tonnes of whole page ads too which wasn't a thing before the last week or so. Annoying!

Got a notification there was a new post on this thread and then guess what, yes the pcsy3hx1 dot online version of the virus alert popped up.

In other words from my notifiactions page, not from a thread.

I've just had the same thing too.
I'm using Chrome on a Windows desktop and I was giggling my way through page 3 of this thread: https://www.mumsnet.com/talk/_chat/5228162-whats-the-craziest-behaviour-youve-witnessed-at-a-christmas-work-do

See screenshot, I'm using Chrome on a PC with Windows 10.
I was on the page about Christmas Villages, (I have seen it a couple of times before over the last few days).
If I hit the 'back button' it returns to the post.
If I close it, it comes out of Mumsnet.
I have not tried clicking on it.
It doesn't appear to be running anything in the background.

Just had the same virus scam message. Again I was just scrolling through list of notifications.

Same url ie pcsy3hx1 dot online

But as mentioned up thread, have also recently been getting redirected to full page ad for esspresso machine. Too irritated to bother noting web age. But this is recent.

Just happened to me again on How does my 13+ apply for Grammar school admission without a 11+ entry exam. | Mumsnet
Screenshot attached from when this happened to me about a week ago on another thread (I can't remember which one now).
Microsoft Edge, Laptop, no ad blocker.

Been happening off & on the last couple of weeks. Only on Mumsnet, various threads mostly in Chat or AIBU, mostly if not all ones I've got to by clicking on the Trending list. McAfee ads (I use a different professional virus tool supplied by a PC maintenance company), doing the Scan In Progress thing

Windows 10 desktop, Chrome.

Still happening. Three or four times in the last week. Happened five minutes ago on my laptop on the thread Titled something like "AIBU to have thought DD could have sat in the high chair. (Or similar)" Screen shot not taken as closed site immediately. Worrying.

I've just had the same thing too. Just merrily scrolling through a thread then bam! McAfee spam page. I closed it but my Malwarebytes wouldn't let me copy and paste the URL and blocked the whole page.

It is a bit worrying that such a mainstream webpage can suddenly be taken over.

The whole page adverts are annoying but not normally overly disruptive, but the other day I couldn't scroll more than a post or two without it popping up again.

I left the website that day because it was too annoying.

Same thing happened at home yesterday and just happened on my work computer. I know it's a scam. Mumsnet website disappears and it's a different url in the address bar. Says my computer is infected and I must click on something - there is no way my work computer is infected. There is so much IT security here!

Re-posting my latest message on the original thread about this issue...

I've had this AGAIN. Not the same browser as before (I used to use Chrome, now I use Edge), so nothing to do with cookies. It was whilst viewing this page:
Niece ruined my phone case, DSis and BIL refusing to replace it | Mumsnet

MNHQ - is your approach still to just block individual adverts as when people come across them, or are you looking at more wholesale changes to your advertising to resolve this? This isn't the only instance of dodgy ads and they seem to be getting more and more frequent - your current approach isn't working.

Coming back to add a screenshot of another one that just popped up.