Assessment:  Two widespread redirect attacks impacting 100's of publishers detected and blocked over the weekend.  The campaign was primarily targeted to desktop Chrome and Safari users displaying various images based on the user's ISP connection.  

One technique deployed utilized typosquatting attack techniques to redirect users to malicious scam pop-ups sites. Fraudsters create legitimate-looking URLs with minor typo errors and host their malicious code in it to carry out the redirect attack. Mostly typosquatting attacks will be unnoticed since they look nearly legitimate. One example in this attack, utilized “” which looks nearly similar to a legitimate domain “” an ad serving domain owned by Sovrn Holdings.

Affected platforms:  Rubicon, Index, AOL/Verizon, AppNexus, TripleLift, Amobee (paused buyer already) & Celtra.

Creative and Landing Page Examples:

Assessment:  New mobile targeted redirect campaign driving users to a common Amazon pop-up interface. Fraudsters achieve this redirect by tracking the basic click event on the malicious ads. The ad shows imagery itself includes a fake notification often prompting users to click, directing them to the malicious page.

Affected Platforms:  MoPub


Landing page:

Assessment: Desktop auto-redirect campaign targeting multiple browsers.  Malicious ads use to host their malicious code and redirect users to malicious landing pages, often containing a fake survey or link to a fake casino mining bitcoins.

Affected Platforms:  Sizmek DSP

Assessment:  Multiple new redirect campaigns detected driving users to .best, .club and .online domains.  Campaigns are using various known methods and fingerprinting to target mobile devices and specifically looking for certain user agent strings.  Fraudsters are looking for known wrappers as part of their execution code.

Affected platforms:  MediaMath, Acuity & Weborama

Sample Creative & Landing Page


Assessment: Redirect campaign emerged 6/13 targeting iPhone and iPads devices across the US.  The campaign utilized a handful of s3 script files attempting to drive traffic to various .icu domains.

Affected platforms:  Beachfront Media

Hijacked creative:

`` `` ``