Hi all.
Still sorting things out from my last post relating to Mesh Networks and WebThings… To be updated.
In the mean tine, curiosity led me to looking at what the page code contains for my page, as it seemed to be very slow recently.
What I found was disturbing, to say the least. To begin with, we have a LARGE block section that begins with;
class=hidden> [
… and ends with ;
]{ display: none !important }
Within this block I have found hundreds of entries, a few listed below…
href^="http://join.shemale.xxx/"],a[href^="http://www.afgr2.com/"],[href^="https://www.brighteonstore.com/products/"] img,a[href^="https://go.goasrv.com/"],a[href^="https://www.arthrozene.com/"][href*="?tid="],a[href^="https://adserver.adreactor.com/"],a[href^="https://refpazkjixes.top/"],a[href^="https://adclick.g.doubleclick.net/"],a[href^="http://vinfdv6b4j.com/"],a[href^="https://go.tmrjmp.com"],a[href^="https://twinrdsyn.com/"],a[href^="http://keep2share.cc/pr/"],a[href^="http://see-work.info/"],a[href^="https://ak.hetaruwg.com/"],[data-ad-manager-id],div[jsdata*="CarouselPLA-"][data-id^="CarouselPLA-"],[href^="http://misslinkvocation.com/"],[href^="https://www.avantlink.com/click.php"] img,a[href^="http://get.slickvpn.com/"],div[data-native_ad],a[href^="http://xtgem.com/click?"],a[href^="https://frameworkdeserve.com/"],a[href^="https://fakelay.com/"],a[href^="http://go.fpmarkets.com/"],[href^="http://join.shemalepornstar.com/"],[href^="https://kingered-banctours.com/"],[href*="incentrev.com/"] img,a[href^="http://clicks.binarypromos.com/"],a[href^="http://pubads.g.doubleclick.net/"],a[href^="https://www.kingsoffetish.com/tour?partner_id="]
This is only a small portion of what was found. Is this injected at the server end or do I have an issue of a trojan somewhere.
I really have no idea why this is there. If anyone would like to look at the whole contents, I can share via Google Drive.
Any ideas?