I don't, and never have, had that TapaTalk app installed on any of my devices … and the redirect has just happened to me again on my iPad.

Mark

Yep, me again, after emptying the history. But this one has a different address than the first one, though the same background image...



All a bit concerning. I realise there's nothing they can really steal here, no payment details or personal info other than email addresses, but would it be an idea to change login passwords?

Judging by the background I'd say this was a message directly from the UN, I'd pay up very quickly.

Oh, I would if only I knew WFT Ukash or PaySafeCard vouchers were! What's wrong with good old fashioned PayPal?

I've never had tapatalk on this iphone or the ipad. Just had the site come up when accessing the forum from a forum link on the homepage of the iphone via 3G.

Is this a shared server? Are any other sites affected?

I just retried this on my iPad - and got a redirect. I noticed that the first redirect was to a domain with the words “moving on” in it - it was quite fast and I didn’t think to screen capture it. It’s odd, because when I tried to re-trip it (clearing cookies, restarting the iPad), it just went straight to the x404 home page as expected. So something is tracking IP addresses and ignoring frequent or closely spaced requests. Odd, but clearly designed to hinder any forensic testing.

What you can try is plugging your iPad into your Mac and using Safari to track what the iPad’s browser is doing. That’s handy for web dev work, but it could also be handy here, espcially if you have screen capture software to grab the sequence of events. I may try that later on.

I’ll try TunnelBear on my iPad - see if a change in “personality” trips it and I may be able to screen grab some transient domain names.

No other sites are getting this and tapatalk had a security breach earlier in the week (maybe earlier than that but they took a while to inform everybody).

There's nothing in the htaccess files etc to do it, malware scans are clean and all the js that's used by tapatalk etc was clean but I removed it anyway.

Looks like more investigation is needed

Looking around, it sounds like it was Tapatalk’s own server that was hacked, but there seems to be confusion over how far the reach is. Tapatalk are saying that the breach came through Wordpress and it affects your support.tapatalk.com login (if you have one). Other services are not affected:


https://support.tapatalk.com/threads/pa ... 443/page-2

I’ll see what I can get by connecting my iPad to my Mac and looking at the dev feedback. I expect it’s timed out and I’ll get more redirects.

Edit:
After a few attempts, I managed to get a recording of a session in Safari (you can do this by hooking your iPad to a Mac and using the Develop menu in Safari to see what’s being loaded etc.). I’ve got a movie of it which I’ve DMed Saspro about. Hopefully it will help in his investigations. It’s a hugger to trip too - I think there’s a script that’s logging IP addresses and only redirecting either randomly, or after a certain amount of time.

It happened today again on my iPhone at work - logged into the college eduroam wifi.
A few of the teaching staff are curious to find out what's been prompting it.
Again, I'm not a tapatalk user, never have been, but interesting to find out how the attack has been engineered.

I've made some changes this afternoon so hopefully it should be sorted after another cache clear.

The site is coming up clean on all the scanners I've found online so unless it's something well above normal access on the server there's no malicious code

Just had it happen on ipad.

http://bananenmeel.bookkeepinggals.com/ ... -6-16.html

Running ios 7.1.2 on iphone 4s

http://mechanicswisepalisses.hecs-cahps ... tique.html

http://yvukevug.uk.to/search.php?pid=44 ... 1A2A45D653

http://puissanceslawy-abbysomali.wotcre ... ember.html

http://angehimmeltem-calyx.hospice-cahp ... erait.html

http://sasiteq.uk.to/search.php?pid=4F4 ... 4C8C18E22C

http://doorzaagde.mynursinghomecahps.co ... ettil.html

Not seen those URLs, but, yes, the problem repeated itself on my iPad. It’s now restarting because the Safari crash was a little nastier this time, it seems.

this is what happans when you mock the illuminati

Getting initially redirected to sanojum.uk.to and then on to bookkeepinggals.com - I can trigger the behaviour fairly easily using TunnelBear to change my geographic location. If I disable JavaScript, then it doesn't happen. Right now, I am wondering about two possibilities:

1 - a file in a Wordpress theme is no longer what we think it is - it's being served as a script instead of an image, for example. The file name says "I'm a graphic" the contents is a spot of JavaScript.

2 - One of those social media buttons has been compromised in some fashion. They tend to be iFrames, constructed with JavaScript, and they load more than an image - they are whole web pages.

I am speculating about these - but with JavaScript off, it seems that the problem goes away.