mjhjmtu

I'm a developer by trade, but not that well versed in information security. I've encountered a strange problem at home:

About three times now in the past year, when I open some website - I'm thrown to some garbage domain which tries to phish me to do some kind of security audit or whatever. First time it happened - I thought I had some malware on my system. I'm normally very cautious. So I pretty much burned my drives and got a fresh everything going. Then it happened again, a few months by, and now again - after moving to a different apartment and on my GFs laptop.

I'm suspecting DNS tampering of some sort, but there's no way to verify. Opening the same domain again, just gives me the right page.

• Between now and then I moved apartments, moved ISP, changed router to Google Mesh, changed DNS to 8.8.8.8 on it. So... now even DNS poisoning doesn't make much sense.




• And the websites that do open, are very similar in spirit. I suspect that the problem is persistent.




• AV software doesn't report any issues.

Any ideas? And what should I do to prevent this?

EDIT:

In response to questions:

• It happened to three different websites. I honestly don't recall which, I think it's entirely possible that it wasn't any of the big ones.




• Visiting the same site again just opens the normal site.




• Last time it happened yesterday (my GF visited some blog. I will update again if she remembers which site it was originally), and this is the garbage result I was referring to: http://play6052.try-it-now3.club/?utm_medium=oxxGrJ1EO8rl%2flkgHhDHtdaJe%2b6y3ml38Z%2b1ZX9QaLo%3d&t=main6_mcas2




• I am in Estonia




• The browsers and machines are completely different. Even the router and ISPs have changed between issues.

EDIT 2

The offending original was:
http://www.byronkatie.com/2018/07/how-to-be-safe-in-the-abyss-the-work-of-byron-katie/

I agree with Steffen, this sounds like malvertising as the most likely cause, with a less likely option being compromise of the visited site with embedded redirects.

Running ad-blockers and script-blockers is effective against most malvertising, but can negatively affect your browsing experience.

Sometimes malvertising is targeted at only certain browsers. I used to have a site I visited regularly that suffered from frequent malvertising on the mobile version. Switching from Chrome to Opera solved that problem entirely. Ads still loaded (I wanted to support the site) but not the malicious redirects.

There's some malware out there that infects websites, but the code is triggered only randomly a fraction of the time.

The site can thus appear completely normal to most, and even yourself after a reload, but will still show the bad stuff once in a while. It may either display directly on the site, or provoke a redirect.

If you have control of the website you went to, check all php code for infection. It is usually quite obvious (a big bunch of base64 at the start of many of the files), sometimes a bit more difficult to find (it may be a single php file that is indirectly included in other pages).

If you don't have control of the website, you may try to alert the site owner, but unless you can pinpoint it quite precisely it may be difficult to get a good response.

Those sites usually end up blocked by malware detectors, including Google, Safari, Chrome, etc. but it may take a while as the scanner needs to stumble on the infected version of the page.