Damn - thought that using profiling I could at least grab the file name of the redirecting script, but you need to know when it's going to redirect. Sadly, I can't set up a "break point" condition to make the script halt when it's going to redirect. So, no luck there. Sorry.

I can confirm, though, it's still there and has rebooted my iPad twice this evening.

'We're so cool we got hacked!'

Just to further confirm that the issue is still occurring, again on my iPad.

Mark

Just out of interest - are you going straight to the forum pages, or to the start page:

www.x404.c0.uk
or
www.x404.co.uk/forum

I thought I might be able to trip it using the iOS Simulator, but so far, nothing. It’s odd because it seems to have some intelligence about it - it knows it’s an iOS device, it knows to not do it every time.

I was wanting to see if I can catch the redirect in a script using Safari’s profiler - if my iPad crashes, I lose the data (and this can cause a crash or a restart). I was thinking that the Simulator might be a bit more robust.

What is odd is that this problem has not shown up on my iPhone at all.

Not seen anything using Firefox on Windows 7 yet.
It's not a script issue as I've set NoScript to allow everything from X404 and there's no other sites listed when I load this page.
I always got straight to x404.co.uk/forum.

It happens whether I click a link on the page, bookmark, whatever. But so far it's only been with mobile browsers.

Does anyoen who's had an issue with it on a mobile run any sort of antivirus on their mobile?

I've had nothing show, but it may be because i log-in from the same IP than the overlord

Nope.

Are people getting redirects from the mail site or are people going straight to the forum (therefore bypassing the WP main site)?

I tend to jump to the index from an old browser link whether desktop Firefox or mobile browser.

So you're going straight to index.php ?

My bookmark is set to http://www.x404.co.uk/forum/index.php and I don't have an issue.

Going to /forum directly.

It only seems to be affecting Safari on iOS and Chrome on Android l3v1ck, which makes me think it has something to do with the Tapatalk process, because on mobile platforms you usually get a pop-up telling you that there is an app available for using the forum, it is when this would normally appear that the hijack starts.