Just recently it seems every page on TL is popping up this dialog saying that my flash player plugin is out of date, and then it tries to redirect the user to download some probably harmful exe file at
http://184.173.28.176/adobe_flashplayer_7.exe (don't go there lol it's probably a virus, athough their server seems to be having troubles)

I have TL+ so it shouldn't be an ad causing this, I think it's coming from your ad providers javascript though, so it works even if no ads are displayed. Turning on adblock doesn't seem to fix the issue.

It happens in Incognito mode as well, so it's not just my user account or anything like that. This is showing up on every page I've tried.

qwA

3 Posts

November 01 2015 00:21 GMT

Same happened to me for a few minutes, on Firefox. I don't even have flash.

GinDo

3327 Posts

November 01 2015 00:22 GMT

Happening to me too. I turned ON ad block and it stopped appearing.

EDIT: page keeps loading though

Die4Ever

United States17750 Posts

November 01 2015 00:26 GMT

On November 01 2015 09:22 GinDo wrote:
Happening to me too. I turned ON ad block and it stopped appearing.

EDIT: page keeps loading though

I do not believe adblock fixes it, I think it's just the server is getting hammered and taking a while to load this malicious script.

scott31337

United States2979 Posts

November 01 2015 00:30 GMT

Me too! I thought I got infected, but if you guys are seeing it too, I feel better. TL got infected instead

Die4Ever

United States17750 Posts

November 01 2015 00:33 GMT

everyone should go here
https://www.google.com/safebrowsing/report_badware/

and report the url, just copy paste this url into the form
http://184.173.28.176/adobe_flashplayer_7.exe

Shock710

Australia6097 Posts

November 01 2015 00:41 GMT

right then a couple of seconds before i could not visit any Tl pages because of this "upgrade plugin" thing, i know not to click it so i close the box and it still redirected me....
its seems to be gone now but im gonna scans on my comp now....zzz
also it seems when the flash thing does pop up it causes the ads to die they just dont load

Epishade

United States2267 Posts

November 01 2015 01:16 GMT

Uhh I clicked it. What should I does?

Die4Ever

United States17750 Posts

November 01 2015 01:36 GMT

On November 01 2015 10:16 Epishade wrote:
Uhh I clicked it. What should I does?

did it download a file? Don't run it, just delete it, it would be named adobe_flashplayer_7.exe

Die4Ever

United States17750 Posts

November 01 2015 01:38 GMT

#10

seems to be fixed

Epishade

United States2267 Posts

November 01 2015 02:50 GMT

#11

On November 01 2015 10:36 Die4Ever wrote:

Show nested quote +

did it download a file? Don't run it, just delete it, it would be named adobe_flashplayer_7.exe

No, it just took me to a website but the webpage didn't load.

aRyuujin

United States5049 Posts

November 01 2015 03:10 GMT

#12

i also got this a bunch

Die4Ever

United States17750 Posts

November 01 2015 03:26 GMT

#13

On November 01 2015 11:50 Epishade wrote:

Show nested quote +

No, it just took me to a website but the webpage didn't load.

you're safe then, as long as you don't run the exe it tried to download lol

c3rberUs

Japan11813 Posts

November 01 2015 03:30 GMT

#14

I just cleared my history and it was gone. Thought I'd share it

R1CH

Netherlands10342 Posts

November 01 2015 04:36 GMT

#15

Thanks for letting us know, seems this was a bad ad. Not quite sure why this applied to TL+ users, that definitely shouldn't have happened.

SetGuitarsToKill

Canada28396 Posts

November 01 2015 11:06 GMT

#16

I getting a very similar issue on mobile TL. When I try to use TL on my phone, sometimes it automatically redirects me to an obvious malware/virus download page which then makes my phone buzz and asks me to "update Android" in broken English. This only has happened when using TL. It started a few days ago and at first I thought it was a virus on my phone, but several virus checks proved it wasn't and when the Flash thing came about I realized it was only happening when I used teamliquid.

I'll include some screenshots of the websites. The main one seems to be a site called cellphone-tips.com
+ Show Spoiler +

I'm no expert, so I don't want to say TL is hacked or compromised or anything, but the fact that it exclusively happens on this site is extremely worrying and suspicious.

R1CH

Netherlands10342 Posts

November 01 2015 18:29 GMT

#17

I did find a few places where TL+ was still loading ad scripts (no ads were actually displayed, just the tag manager). These came from Google and comScore which should be reputable so I'm still not sure why TL+ users were also affected. I removed the unnecessary ad tags which should also make the page a tiny bit faster for TL+ users.

scott31337

United States2979 Posts

November 01 2015 18:57 GMT

#18

Thanks R1CH for all the hard work you do

R1CH

Netherlands10342 Posts

November 01 2015 21:34 GMT

#19

Seems a 3rd party analytics company we use to measure adblock rates was compromised through a phishing attack. We're going to remove their code for all users.

http://blog.pagefair.com/2015/halloween-security-breach/

SetGuitarsToKill

Canada28396 Posts

November 07 2015 10:15 GMT

#20

On November 01 2015 20:06 SetGuitarsToKill wrote:
I getting a very similar issue on mobile TL. When I try to use TL on my phone, sometimes it automatically redirects me to an obvious malware/virus download page which then makes my phone buzz and asks me to "update Android" in broken English. This only has happened when using TL. It started a few days ago and at first I thought it was a virus on my phone, but several virus checks proved it wasn't and when the Flash thing came about I realized it was only happening when I used teamliquid.

I'll include some screenshots of the websites. The main one seems to be a site called cellphone-tips.com
+ Show Spoiler +

I'm no expert, so I don't want to say TL is hacked or compromised or anything, but the fact that it exclusively happens on this site is extremely worrying and suspicious.

Bumping to say that I encountered this again. It went away for a few days. Perhaps this is on my end though, but it happened again when using TL