Spam redirects from forum pages

[per1234]

We are seeing many reports of malicious redirect activity on the forum, some from well established members:
http://forum.arduino.cc/index.php?topic=469350
http://forum.arduino.cc/index.php?topic=469325
http://forum.arduino.cc/index.php?topic=469132
http://forum.arduino.cc/index.php?topic=468813
http://forum.arduino.cc/index.php?topic=468774
http://forum.arduino.cc/index.php?topic=468746
http://forum.arduino.cc/index.php?topic=468744
http://forum.arduino.cc/index.php?topic=468723
http://forum.arduino.cc/index.php?topic=468666
http://forum.arduino.cc/index.php?topic=468286
http://forum.arduino.cc/index.php?topic=468213
http://forum.arduino.cc/index.php?topic=461944
http://forum.arduino.cc/index.php?topic=461803
http://forum.arduino.cc/index.php?topic=459538
http://forum.arduino.cc/index.php?topic=457799
http://forum.arduino.cc/index.php?topic=451182
http://forum.arduino.cc/index.php?topic=440489.msg3122094#msg3122094
http://forum.arduino.cc/index.php?topic=273758.810

[per1234]

I'm using the NoScripts Firefox extension and I haven't been seeing this problem since I installed it (it did happen to me before that). I just temporarily allowed google-analytics.ga, which had previously been blocked by the extension and after doing that the first forum link I clicked on I was redirected to a site ouo.press with a captcha and got a popup from popcash.net. This is consistent with the [conclusion the forum members had come to in the German forum section. Now that I can reproduce the problem I'm happy to provide any necessary information.

[smellai]

We found the issue, but we are not sure we completely fixed it. Let us know if it happens again. Thanks everybody for the reports, especially to the people that found out the fake google analytics scripts!

[tttapa]

Just happened to me again. Got redirected to ouo .io and got a pop-up from popcash .net.

[IamFof]

Hi guys.
Looks like this issue is still causing problems.
Attaching screen grab and page sources of the ones I got today.

Fof
Doc1.docx
ouo.zip
popcash.zip

[jonathanperret]

I just got a fake Google Analytics snippet from https://my.arduino.cc/en/pub/js/newsletter_subscribe_popup.js . Might have been from my cache though, as currently this URL returns a 503 error.

[per1234]

I have disabled my NoScript extension from blocking scripts on arduino.cc and I just got a redirect from a forum link to ouo.io and a popup from popcash.net.

[WestfW]

Still happening to me as well. Mostly this happens on my iPad; I think this is the first time I've seen it happen on my desktop.
Got redirected to http://ouo.press/cNSjk5 when I clicked "updated topic", plus a popup to http://www.fungamechallenge.com/landing/index.html

I don't see anything interesting in the page source (assuming it didn't reload when I went "back" to it.)

[sterretje]

Had it again about 12 hours ago on my tablet. So I do not think it's solved yet unless I have to clear my caches and history. I could not report here at that time, sorry.

Because I'm running NoScript and ABP in Firefox on most of my PCs, I don't see the crap on there.

Can we get some feedback if the Arduino web staff is still working on it?

[sterretje]

Still happening
got a popup "googleza.virusid.pro says" a few hours ago.

[per1234]

Same here. I got a few ouo.io redirects just a few minutes ago. Had to disable scripts again just to be able to browse the forum.

[smellai]

Please flush the cache and let us know if it happens again

[dotto59]

Just happened to me too. Chrome with AdBlock, Italy (and italian forum). As soon I logged in the forum (I have a shortcut to it saved in my favorites) the browser showed a "Blocked popup" icon at top right for a few tenths of seconds, then the forum page has been replaced (redirected) by an "ouo.press" ad (I suppose it did that after checking the popup has been blocked). After the first time, the popup doesnt appear anymore, until next time I access the forum with auto-login.

This is REALLY an annoying and nasty thing, preventing me and thousands of other users from using the forum freely, so I think it's a problem TO BE SOLVED QUICKLY!

[sterretje]

It seems to be solved, thanks.

Cleared the cache on my cellphone two days ago and have not had the issue again.

I forgot to clear the cache on my tablet and it still happened; cleared it about 8 hours ago and will try to remember to provide feedback in a day (or two) when I'm confident that it helped or not.