1

An advertisement keeps popping up for me on multiple sites which redirects the user to a scam form after a delay of a few seconds. I was able to identify the culprit by this warning triggered in Chrome when an iframe redirects the top-level page:

Frame with URL 'https://content.targetix.net/Hybrid/8C98EC32E9623FA39ADAAE7EFBCE00F8/index.html?ri=False&seanceId=CF10F4F92E87EDBC9FD2B3847AC626A3&cu=https://dsa.targetix.net/?_72R0MPamIN8uhOnJ1tPxJTY7O6pkkHxk0H3LhzLqvHanD9RXfDQE9UWJGXIqgRmhb5dtVQozHlxrArsp16ElIsTnSbyFiAydthS5TOlJKyMyEgX.pjly5bTNu39T3LOCHpCyLpGyPvmCu1QZpJxSNqf7vmkVVsq_ffKzE8dQo5bq0SuwjZvGIvNY1V5UGcXlIUuZ.zNjpP7o6uEEDk_V6IL8ivIE1w1GvUZ.6VSruftcgZ5GC5gpmHiH0lSt_GLmxhzUQ6zd7ZIPFRLNv0VlX1ZDuwSZlyeD_rmMngATy.2V2N3SFkSEp4V7Bu6I3n0Mry0w2WuORdDNImq51GUu0wlNZt_qog6BnCtrGUZHnfXN9QJKyjiYM6T_UCtdJ6g5eCRR_E6GI143mubHmRxCchEMeMWkucFbRFyAFjVtIis1P7V_ho0d9F4SfPEUDPfKFPTGq1g9oSvz8a48rrrpBUOwzaYcbmjvjhj.eU4f2DncxqKGxd.th8VgIk69tz6HOUNgXwgZSu7qSOsCYRbXzAmrOtEBOE_5EreajvjJA1HY4YhFG55F_a9MIS1.UnIFPXjfMeWpdvDBT4HrUI0RvDjR9LHPcVAffR1MR_JL9WCTkljrkkbqbMFsrFtRIUV.hBX_4r6_ttEPiSeZx7tPzCoPGzzMboS0tk.qHJSV3S3lBjZ1lWZmGfDyjPQmt.Hr8ALr5HNdFnC2_gl1LNJAmw' attempted to navigate its top-level window with URL 'https://...'. Navigating the top-level window from a cross-origin iframe will soon require that the iframe has received a user gesture. See https://www.chromestatus.com/features/5851021045661696.

(Site URL removed.)

The ad redirects to

https://prx2tst.global.ssl.fastly.net/in/ads_n00171528/?ads=wy4enxv9bs&sspid=pubmatic&referer=https%3A%2F%2Fdsa.targetix.net%2FOpenRtbDelivery%2FMarkup%3Fr%3Dszeuxjfdgs%26id%3D112%26ope%3D_Y3SZ3_x_ewux.mtI8WooM_gjYmIG9_GVj5dLiTt1XdyUtrN7i.bnMEG4CR.vKIfHmXzQRLqAa.V1Trt_dJmqUTYW0NRKvAOlbMUxuub1p4bXfYrVhINfw_x6P888zueDtQu0YXP_.5SPWIFGQDRdc48XCmHNZVwQanNa2XfKLm8f7cuE5obK1S0SYf72jsJlYhhP6.gbKeFjYeR63IJAqmmJL0NGHj6yP1y2Q3XSQcD0DwXCz3xTt2mZPOgM9HW70I2gvgHSqAsvKYaJQ_4k6cGmhvcUZnK1B4KNmA93r0AofWsO8iF7Ie1C1iL0F0IMbayAz3EeyyGG1cMxN7DR7XBIgSCaVSj8oRgNxxVGMqdXz575eHdKADiSVbAsWTj6IeScTlJSLc7jVYxFULyBSboFX0zvNYLAPXMTG8jIi69c4Ja9Gi9NsVk.Il0eBEFjkfwEtIhW.1CSRYkX.TrcAqZfd03brdI90OkQp2x71brnMAFHcX93BxIGjS1Cte4B%26cturl%3Dhttp%253A%252F%252Fclicktrack.pubmatic.com%252FAdServer%252FAdDisplayTrackerServlet%253FclickData%253DJnB1YklkPTE1NjMxNSZzaXRlSWQ9MjAzOTAwJmFkSWQ9MTEwNzIwNyZrYWRzaXplaWQ9OSZ0bGRJZD0wJmNhbXBhaWduSWQ9MTY1MzAmY3JlYXRpdmVJZD0wJmFkU2VydmVySWQ9MjQzJmltcGlkPTZGQ0MxQTcwLTE4NzAtNDgwNC04OEEwLUE1MTE0RDA5RTYyMiZwYXNzYmFjaz0w_url%253D&p=ads_n00171528&click=%7Bclick_url%7D&sitedomain=thenextweb.com&rand=null&pubid=pubmatic_156315&siteid=null&location=https%3A%2F%2Fdsa.targetix.net%2FAd%2FLoad%3Fsrve%3D_TuKEaJoPyPaaQ.VNzigi_jCjQ7QQduBe9R7ZGrftR7RwXwJbIKXUmbMotdXYbpaNglt4VYb3FusXUhDYw8Qo.C6m65c7Kx8ptaA.0jHhXMJMdmKkhg13Uy1wxr3AfjJLXFahQC7lSUY7GaApX5BcOGon.7kUrPeeW8Ypbm9J66letZk5oKUbdKtLkkoe2uFdddZUabGwMIO1drscMzWP2AAY0k7.w.2uKiqPH8P4Q_bLDEZglnNKCTNgfyQeaX9ATHm3ph7NujLf2BlbOvAorcTr8V7JAvKBWkShekkoRmjeV18LM5LTsS4W_qO8DIXCOHqluEVPAG39YhYPRh6qFNET5U88wuS1qaxnKXN8vc5KR71qvkie.tsi3tun.OU5kaYCnqt.TG.Ew8d.X8HryxV9tuHZCNU5.wotqDsstsCOlkftlWB0djpGjD.QDjP5I7w9GxFHw3scTehqUASUjClobT9PZUYW8x6DMHqzjPs%26ctu%3Dhttp%25253A%25252F%25252Fclicktrack.pubmatic.com%25252FAdServer%25252FAdDisplayTrackerServlet%25253FclickData%25253DJnB1YklkPTE1NjMxNSZzaXRlSWQ9MjAzOTAwJmFkSWQ9MTEwNzIwNyZrYWRzaXplaWQ9OSZ0bGRJZD0wJmNhbXBhaWduSWQ9MTY1MzAmY3JlYXRpdmVJZD0wJmFkU2VydmVySWQ9MjQzJmltcGlkPTZGQ0MxQTcwLTE4NzAtNDgwNC04OEEwLUE1MTE0RDA5RTYyMiZwYXNzYmFjaz0w_url%25253D&dt1=0&dt2=0&dt4=2&dt5=0&dt6=0&dt7=0&dt8=17&dt9=NA&dt10=no%3A25%7Cblogger%7Ccarbonmade%7Camazon.com%7Cbattle.net%7Cairbnb%7Cfacebook%7Cexpedia%7Cedx%7Cfoursquare%7Cgoogle_plus%7Chackernews%7Cmedium%7Cmeetup%7Cflickr%7Ckhan_academy%7Creddit%7Cindeed%7Cpaypal%7Cskype%7Cstack%7Cvk%7Ctumblr%7Ctwitter%7Csteam%7Cpinterest%3Bok%3A6%7Cdropbox%7Cdisqus%7Cgmail%7Cbitbucket%7Cgithub%7Cyoutube%3Berr%3A4%7Cacademia.edu%7Cspotify%7Csquare%7C500px&dt11=1

and lands on the scam page after a few redirects, though these redirects could be different for different users. I was not able to reproduce the redirection when opening the ad frame in a new window, either. It seems that the ad is sending some parameters to a server first to check whether it should do the redirection or not. In fact, the ad first downloads a script from maguiredigital.com/html, which in turn fetches the following JSON string from trustedmarketings.com:

{
    "location": "https:\/\/prx2tst.global.ssl.fastly.net\/in\/uid-120ena-cid-90128p0079065\/?ads=en6s9of8l5&sspid=pubmatic&referer=https%3A%2F%2Fdsa.targetix.net%2FOpenRtbDelivery%2FMarkup%3Fr%3Derfadtipho%26id%3D112%26ope%3D_VxMyzLeZ6T2.prlsbzJlaE2uIu84try8s10D8eDaPsns4DXoVUGJkzPLl8C4YWiMsECcXk_IHdahFNJMX.J5gSDgNpP0K_Z39B150YraZmwKB19AlNUWnS3K8EAJm8YEx1E9nAE1rK9DCRRsblir.jEe8bqasn6hNv2Iz5u.XCQ40Ej_pwf.PhK9Rf0pYsb_v.YsqqZ.HZn5GYFt5eDdHsGff.24VfkvzNEJf1r98OMmTQY_1s.ZLXlgi9a9jL9oelJibvPS16U52_cnQQrFEOnHr485IjxCxNfTVL8zhrZ5T3WGLnGoedmWHEJrZ.n7fnryPh6GNNL8xya9W3YXy_JPeTvna1kwINnA.kNM_NsiqzbhTM6nPYBlb3zqeDsKCDHi2wtthw9hSDOKm5C1Y8Yh27xfeICjEwzA2ms4tPbFCasRKya_hdl4RwmF9cf8%26cturl%3Dhttp%253A%252F%252Fclicktrack.pubmatic.com%252FAdServer%252FAdDisplayTrackerServlet%253FclickData%253DJnB1YklkPTE1NjIxMiZzaXRlSWQ9MTg2NjYxJmFkSWQ9MTA0NTc4NCZrYWRzaXplaWQ9NyZ0bGRJZD0yNTEzMDg0NSZjYW1wYWlnbklkPTE2NTMwJmNyZWF0aXZlSWQ9MCZhZFNlcnZlcklkPTI0MyZpbXBpZD0wOTJBMUQ5OC0xRDVCLTQxNkItODIwOS1BODhEMUY5QURFQkEmcGFzc2JhY2s9MA%253D%253D_url%253D&p=uid-120ena-cid-90128p0079065&click=%7Bclick_url%7D&sitedomain=zerochan.net&rand=null&pubid=pubmatic_156212&siteid=null&location=https%3A%2F%2Fdsa.targetix.net%2FAd%2FLoad%3Fsrve%3D_P__kWXxyZ9cuHi3wc6TMYQfrmot2fEO7b1ZkIV8wnpcoIoY09DekJ4fjv.bJ3p2AZIJa4SH3yaE60hM_6kzFu4hw0xNnY0yY82ZReHW0lhFWwoOJwzewchGlFkuzB.0f2JIsDc64tcuuvj0dbh8USIlu_8hEjTiXHjM3_.7kx2idyqP0l_mR_pZdpFhqtuYqFPhCmZept62bpPPLNtfrt86nTutPKXHClBD55k6efPuEbQBz3nNJLxrZeUlGZCba2YxkRqm2nXMlT03vNZtCHaGmbKJSY3vwKwP43_iR1WNggJMV8PEY87Pe8seegiGAbLJOlA96o_gPF29i0FHJJdOaGZOKH.EZusEUgjKet3C93GMatCBxz9h_P7p5Bbyy_BITgi04PDgAynnq.1ki3MRkoxV_fnsn4Ih9Bctp.5ZGE_TyQd.jpVMbAsYAKd0Y%26ctu%3Dhttp%25253A%25252F%25252Fclicktrack.pubmatic.com%25252FAdServer%25252FAdDisplayTrackerServlet%25253FclickData%25253DJnB1YklkPTE1NjIxMiZzaXRlSWQ9MTg2NjYxJmFkSWQ9MTA0NTc4NCZrYWRzaXplaWQ9NyZ0bGRJZD0yNTEzMDg0NSZjYW1wYWlnbklkPTE2NTMwJmNyZWF0aXZlSWQ9MCZhZFNlcnZlcklkPTI0MyZpbXBpZD0wOTJBMUQ5OC0xRDVCLTQxNkItODIwOS1BODhEMUY5QURFQkEmcGFzc2JhY2s9MA%25253D%25253D_url%25253D&dt1=0&dt2=0&dt4=2&dt5=1&dt6=0&dt7=0&dt8=13&dt9=NA&dt10=no%3A32%7Cblogger%7Ccarbonmade%7Camazon.com%7Cdisqus%7Cbattle.net%7Cairbnb%7Cfacebook%7Cgmail%7Cbitbucket%7Cedx%7Cgoogle_plus%7Cexpedia%7Cfoursquare%7Cgithub%7Cflickr%7Ckhan_academy%7Cmedium%7Cmeetup%7Cindeed%7Chackernews%7Creddit%7Cpaypal%7Cstack%7Cvk%7Cpinterest%7Cyoutube%7Ctumblr%7Ctwitter%7Cskype%7Csteam%7Cspotify%7Csquare%3Bok%3A1%7Cdropbox%3Berr%3A2%7Cacademia.edu%7C500px&dt11=1",
    "time": 25000
}

Through a quick search, I was able to find a few other users suffering from the same issue, and it seems like it's been going on for months.

How can I figure out who is serving this ad, and where and how to report it? The visual presentation of the ad does not contain the AdSense logo or any buttons or links to report it, so I assume it is from some other provider.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.