hmmm malware?

[darkoshi]

This is the 2nd time in about as many days that when clicking a link, I've gotten a page like this, which is not the link I clicked:


[Firefox Logo - making it look like it's a Mozilla survey, but it isn't]
2019 Annual Visitor Survey undefined
Browser Opinion survey
April 21, 2019
Congratulations!

You’ve been personally selected to take part in our 2019 Annual Visitor Survey! Tell us what you think of Firefox and to say “Thank You” you’ll receive a chance to get an Apple iPhone Xs!
Question 1 of 4:
How often do you use Firefox ?

When I go back and click the link again, the expected page opens.

Today it happened upon clicking a link in the Google search results. Yesterday, I don't remember which page I had clicked the link from.

It seems to be malware:
https://duckduckgo.com/?q=firefox+%222019+Annual+Visitor+Survey%22&ia=web

(But none of the links in those search results look particularly trustworthy to me.)

An MBAM scan didn't find anything.
Currently doing an scan with my antivirus software.
... it didn't detect anything either.

This has been happening in Waterfox. I wonder if one of my add-ons got hacked. Hopefully not Waterfox itself.

Or maybe the sites that the links I clicked go to were hacked, to occasionally redirect the visitor to this bogus survey site. Both times, the domain of the survey URLs were different:
http://prize8384.bestlifehere24.life/...
http://competition8713.bumblbee82.life/...

Comments

[marahmarie]

Results in both DDG and Google are uniformly garbage for that search, so questions:

--Are you clicking links in search results that bring you to the fake survey?
--Is it a redirect to a website or do you see a popup window in the browser (I'm mostly seeing the latter screencapped in search results I check)?

I'm just curious when/where one might run into this so I can try to avoid it. My use of Waterfox is limited to sorting/storing/reading bookmarks and doing CSS stuff on DW but that said, I have Waterfox "customized" a bit: after I installed it maybe over a year ago, I went into about:config and ripped out anything that can update the browser or my add-ons, because I didn't want my (mostly ancient) add-ons breaking with auto-updates.

Whatever I did worked, so I need to watch things - maybe a bit more carefully than most.