Browser Hijack Spam - Advice for avoiding it is in the OP

[ibd77]

EDIT:

This is happening on the CHROME MOBILE BROWSER and Chrome-based browsers mainly. It is a kind of exploit of your browser.

1. Delete your Chrome browser cookies and don't visit BigFooty on the Chrome browser or you will just get the cookies again.

2. While it is being fixed, please try using the Safari, Brave, DuckDuckGo, or Firefox browser.


IPHONE USERS! Potential solution here:

Browser Hijack Spam - Advice for avoiding it is in the OP

Yes, as I said, I did this earlier today. Might need to update the thread title 😝

www.bigfooty.com

- Chief


======================================


Been getting high jack spam on this site when using via smartphone. Can this be addressed?

 

[Chief]

Been getting high jack spam on this site when using via smartphone. Can this be addressed?

View attachment 1435328

Any more info?

Phone make? Browser?

Any ads you can see on the page at the time?

What's the URL there?

When did it start? Is it still happening?

 

[ibd77]

Any more info?

Phone make? Browser?

Samsung S20FE, Google chrome

Any ads you can see on the page at the time?

Telstra screen as per screen shot

What's the URL there?

Yes but only get a partial in the screen shot.

When did it start? Is it still happening?

The last 2 days or so.

 

[ibd77]

 

[Chief]

I have asked our ad people about it. I haven't seen it and nobody else is reporting it.

Do you have other apps open at the same time? Anything else suspicious? Does it happen on a particular page or section?

 

[hawkman]

I have been getting it as well

Getting the optus version. Same Peter Stefanovic article

 

[Chief]

I have been getting it as well

Getting the optus version

Thanks - ad people have seen it and are working on it.

 

[Jhye Clark 13]

I've been getting it for 3 days.

 

[Chief]

I've been getting it for 3 days.

View attachment 1435714

It's been found - rogue ad in Google advertising network. It's been sent to them to bop on the head.

 

[Chief]

I've been getting it for 3 days.

View attachment 1435714

Is it still happening?

 

[Jhye Clark 13]

Is it still happening?

Not since yesterday.

 

[Chief]

We have found that this is a browser hijack malware on Android phones:

Remove Luckyguys.xyz Malware (Android)

Luckyguys.xyz is one of the Browser Hijackers which are taking over the users’ browsing apps and filling their monitors with sponsored advertisements.

howtoremove.guide

ibd77
Jack The Godfather
hawkman

 

[ibd77]

We have found that this is a browser hijack malware on Android phones:

Remove Luckyguys.xyz Malware (Android)

Luckyguys.xyz is one of the Browser Hijackers which are taking over the users’ browsing apps and filling their monitors with sponsored advertisements.

howtoremove.guide

ibd77
Jack The Godfather
hawkman

Cheers, haven't notice any issues since.

 

[Chief]

Cheers, haven't notice any issues since.

Possibly your phone or browser updated with a patch.

 

[Jhye Clark 13]

I've had no issues today.

 

[Chief]

We made no changes so it's good to see it's being sorted out by Android/browser developers.

 

[cats_09]

Hiya Chief

I've had a regular poster advise that this issue has returned this morning after being all good over recent days

 

[Jhye Clark 13]

Returned for me too.

 

[ibd77]

Getting it again.

http://luckypapa.top/bonus/com-au-ipx-s10-p-new-cdn/lp3.php?c=42z8ujq8z3yz0&k=9857fcbb75a93fabbc9f980fcbe098eb&country_code=AU&carrier=Telstra&country_name=Australia&region=New%20South%20Wales&city=Sydney&isp=Telstra%20Pty%20Ltd&lang=en&ref_domain=www.bigfooty.com&os=Android&osv=12.&browser=Chrome&browserv=103&brand=unknown&model=unknown&marketing_name=SM-G781B&tablet=2&rheight=0&rwidth=0&t1=2369-85a5b91346ef532-215&t2=bigfooty.com&t3=gothamads&t4=1.147.80.0&t5=&t6=&t7=&t8=AU&t9=WnWMTY1NzE1MzY0NTg0Ng&t10=103&t11=bigfooty.com_d64e94af24d3&t12=f0385a01584c096c65941b72ebe493fd&t13=2||bigfooty.com||bigfooty.com&t14=el&t15=&et1=&et2=&et3=&et4=&et5=&e=5

 

[Chief]

Hiya Chief

I've had a regular poster advise that this issue has returned this morning after being all good over recent days

Did you give them the link I posted? I put it in the OP as well.

 

[Chief]

ibd77 - Try the link I posted? The best info is at the end of that article I think.

I don't have any Android phones in the house so I can't really help you.

 

[Cataholic]

Did you give them the link I posted? I put it in the OP as well.

I've followed the link, downloaded the file, but it simply refuses to open / launch.

Tried it repeatedly, but no luck.

Not sure if there's a glitch with the download (tried it multiple times) or if the malware is somehow detecting / blocking it?

 

[TubbsFarquhar]

Yep, they're back for me, and I've updated my software too.

 

[Hubnester]

I got this a couple of times yesterday as well.

Be careful guys. This isn't necessarily malware on your device but more likely an exploit run through the ad provider. In doing a bit of reasearch this has affected other forums and websites in the past and a few claim that they're seeing it on their Apple devices within the last couple of years. Over time exploits may be patched on certain OS or browsers and it looks like over the years they've been knocked on the head before finding another way through.

Chief - the site you posted gives me a bad feeling as well - 'howtoremove.guide' looks like a typical scareware page designed to get people to download their 'spyhunter' software. Chances are this could be malware disguised as antivirus, or software designed to create false virus alerts, prompting users to pay to 'fix' them. A look at some reviews around the internet seem to think so as well.

 

[ubiquitous226]

I've had this multiple times over the last few days, has only appeared on my mobile and on BigFooty, link is for "luckypapa.top" as per one of the other screenshots, although I get an 'iiNet' flavour noting they're not actually my ISP.

• Pixel 6 Pro
• Chrome Android