Okay, the weirdest thing in the world happened today. I tried visiting an archived old article from reuters.com (yes, the news agency), because the link didn't work on the live reuters.com website. Here is the link (replace hxxp with http obviously)
hxxp://web.archive.org/web/20110304111913/http://www.reuters.com/article/2007/05/29/idUSN2924142520070530
The article loaded for a second, and then I was redirected to a shady website. Then, I tried the link above again, shady website again. Here are the sites
First attempt at accessing the article, my browser went through those urls:
hxxp://zl.zeroredirect1.com/zcvisitor/2118c8b6-bfac-11e4-a8a6-0604825553da
hxxp://zl.zeroredirect2.com/zcredirect?visitid=2118c8b6-bfac-11e4-a8a6-0604825553da&type=js&browserWidth=1440&browserHeight=789&iframeDetected=false
hxxp://www.eezdownloads.com/pc/gr/alert/warning.html?osv=Windows%207&voluumdata=vid..00000003-2706-4b3d-8000-000000000000__vpid..e75b8000-bfa5-11e4-802c-f72dac6aec9b__caid..30f572d0-cfe5-4605-84c2-06424ca9a325__lid..46820350-8216-46c5-aee5-718f6ed3c576__rt..DJ__oid1..0f350935-e16c-4694-97ad-42ed1dad7dfc__var1..hotel-hep-Znpj570x__var4..NON-ADULT__var5..DOMAIN
Second attempt:
hxxp://y80pkn2ws1l8y6qb1lcsggi.apkoyunindir.net/index.php?z=ZHZ1a3ZvPWp3d2V2a3dnJnRpbWU9MTUwMzAxMDAzODgyNjA3MDAyMyZzcmM9NjMmc3VybD1qcy5wcm
9qZWN0aGFpbGUuY29tJnNwb3J0PTgwJmtleT0zNkE0RUFBNSZzdXJpPS8=
hxxp://y80pkn2ws1l8y6qb1lcsggi.apkoyunindir.net/VQBSARkHTgM.html
Seriously, I do not know what going on. My computer never, ever had problems with adware/malware/spyware ever since I installed the OS, no suspicious processes or anything like that. No suspicious pop-ups or redirects before and after visiting the (what should be an innocent) archived article ever, not any suspicious sites where open in other tabls/windows when I visited the archived article. Adobe Flash and Adobe Reader are the only browser plug-ins I have on Firefox (plus AdBlock Edge extension)
Do you guys get the same problem when visiting the link? (do it in a protected enviroment like a VM obviously).
PS: Either something happened with the adservers (although I have adblock), or archive.org miscalculated a hash and deduplicated two files that weren't the same. I can't give any other explanation.
