Has this website been hacked

RandomQ

Someone brought me a laptop to see if I could sort it out.

It had a fake verbal error saying it had malware so they just shut the lid.

I looked at browing history and found it seems to have been triggered by visiting a website, I suggest you do NOT follow link if you use your Windows PC on an Admin account.

The page goes to an ad rotator, which serves up a load of bad websites, from fake malware to fake Java updates. It also seems to try to deposit a load of stuff

The script is smart enough to load the normal site if I use tools on it, and responds differently if I point different browsers to it or access it from a VPN.

The PC itself may be infected from visiting the site but at this stage I am just trying to ascertain whether others also find it serving up malware ????

The site that I think is infected is below, I have added spaces to prevent anyone clicking by accident, proceed at your own risk:


http:// mydeposits . co . uk

Please post here if you get same sort of fake pages

A view of the fake windows support page is shown here



Full report on that single page is

https://tools.pingdom.com/#!/dzVcf8/http://therockyledges.tk/index/?1631501756857

forgotmyname

Trustpilot gives some lovely reviews of them. (NOT)

dogmaryxx

Visited https://www.mydeposits.co.uk/"] and it's fine.

Chrome W10

grumpycrab

RandomQ wrote: »

...Full report on that single page is

https://tools.pingdom.com/#!/dzVcf8/http://therockyledges.tk/index/?1631501756857

mydeposits (web page) is ok, not quite sure where therockyledges came from but best avoided...

RandomQ

The first time I visited the site it was fine, but subsequent visits did the redirection to about 20 sites (I have them in history).

I had an external disk with utilities on it and when these sites launched they were trying to access the drive.

I ran malwarebytes on the laptop with no findings.

It is not an issue of the browser as it occurs on Firefox, Chrome and Opera, albeit that different bad sites are loaded.

Any ideas of how to figure this out would be appreciated.

They do not use an admin account, so they do not have access to etc

MyDep is a wordpress site, so not inconceivable that they installed a dodgy free plugin

grumpycrab

RandomQ wrote: »

Someone brought me a laptop to see if I could sort it out.

What router does the "someone" have? (Thinking DNS hijacking).

RandomQ wrote: »

The first time I visited the site it was fine, but subsequent visits did the redirection to about 20 sites (I have them in history).

On the "someones" computer or your own?

RandomQ

They first had the problem whilst visiting me, they were using local hotspot, I did not want it on my network so have got their login and their laptop,

As I said the first time I tried it from scratch it loaded but it was not the root page of the site but one from their history.

I then went to the root and BAM all hell let loose, it went through all these URLs. I terminated browser.

Since then it launches every time in any browser.

Do you mean the ISP router?

I have used their Laptop for two days and the MyDep site is the only one that triggers it.

I have seen Wordpress add ons with adware that do this sort of thing, they used to be kicked off by going onto eBay or anything financial. They only launched once so you uually did not notice.

I guess the next stage is to try another PC on the hotspot and see if it kicks off.

grumpycrab

RandomQ wrote: »

They first had the problem whilst visiting me, they were using local hotspot, ...
Do you mean the ISP router?

What generates the hotspot and what does it connect too to exchange data with the Internet (sorry not an expert but have had a rare issue with a hacked router.)

debitcardmayhem

Change their laptop wifi adaptor to use 8.8.8.8 or 1.1.1.1 as the dns server, then see if that stops it , the hotspot could be messing with DNS

AndyPix

Clear cookies, check installed browser addons, check no manual proxy has been added

RandomQ

grumpycrab wrote: »

What generates the hotspot and what does it connect too to exchange data with the Internet (sorry not an expert but have had a rare issue with a hacked router.)

It would be ironic if it was router.

It is my boss's kit, he has a router that is a copy of one we use in office for our personal wifi.

It connects to BTWifi-with-Fon

So if it was his router I guess he would need to do a firmware update.