Nefarious Ad trying to initiate fake flash download

[VrabelJr]

Attached is an image of the popup I received. It mentions "explorer" as the browser I'm using but I'm actually using Firefox.

Clicking OK redirected me to a link to download a .dmg file (I'm on OS X) for something called Mplayer. This is the link I was redirected to:

http://kingsdowns.com/hehe/js/ca/index.html?kw1=xad61-usca-728-js-ly&kw2=flv-ca-apx&id=96

There was a long tracking code assigned to the "q" parameter but I've removed that for privacy reasons.

 

[Ian]

Attached is an image of the popup I received. It mentions "explorer" as the browser I'm using but I'm actually using Firefox.

Clicking OK redirected me to a link to download a .dmg file (I'm on OS X) for something called Mplayer. This is the link I was redirected to:

http://kingsdowns.com/hehe/js/ca/index.html?kw1=xad61-usca-728-js-ly&kw2=flv-ca-apx&id=96

There was a long tracking code assigned to the "q" parameter but I've removed that for privacy reasons.

I'm still trying to pinpoint that and narrow it down to what network is serving it. It's been frustrating because it only happens occasionally per session and only one time, and after that it doesn't do it again - almost like it's limited to once per day to make it tougher to trace it.

 

[VrabelJr]

I'm still trying to pinpoint that and narrow it down to what network is serving it. It's been frustrating because it only happens occasionally per session and only one time, and after that it doesn't do it again - almost like it's limited to once per day to make it tougher to trace it.

Yeah I figure it's a case of an ad network getting jacked and would be really hard to troubleshoot.