Earlier this week I mistyped the address of a site I use and my laptop’s browser flickered through three or four pages I didn’t recognize and settled on a “Verification Required… checking if you’re a real user” screen before dumping me on a VPN company’s homepage. I was decidedly annoyed as there was something malicious at play here and resolved I was going to file a report. Before doing so, I wanted to dig in and see what else I could find so I tried the same address on my iPhone. The phone began popping up “Call…?” prompts for a run of different phone numbers one after another faster than I could dismiss them.
NNow to be clear, nothing actually dialed as iOS asks before a web page can start a call, and each call prompt replaced the next other before I had a chance to hit anything, but I just closed the browser. I spent the rest of the night pulling all this apart. What I found isn’t exotic or anything, it’s more/less a pretty ordinary piece of the machinery that a lot of web scams run on, but that’s why I think it’s worth writing up.
(If your concern is your own website redirecting visitors, that’s a related but different problem; I’ve covered it in Why Is My WordPress Site Redirecting to Another Website?)
The Typo Was The Product
The misspelled domain had been registered years ago and parked. Most people picture a parked domain as a dead page with a few ads and a “this domain may be for sale” banner, and some of them are exactly that. Others are wired into a market where your visit gets sold the instant you arrive and whoever owns the typo earns a little every time someone makes the same mistake I did.
The first thing I checked told me this one wasn’t innocent. When I asked for the page the way Google’s crawler does, I got a plain parked page; when I asked for it as an ordinary browser, it redirected immediately. Showing search engines one thing and people another is called cloaking and there’s no legitimate reason for a parked page to do it. The point is to keep Google (which would happily flag the domain) from ever seeing what real visitors see.
A Routing System Dressed Up As A Tour Company
The redirect went to a domain named like a small New England tour operator but there was no tour company, just a traffic distribution system: software whose only job is to look at each visitor and decide whom to sell them to. Device, operating system, browser version, country and internet provider all get weighed in well under a second and the next link in the chain comes back stamped with a publisher ID, a campaign number, an ad creative and the price paid for my visit which was a fraction of a cent.
The page that does this contains no readable script at all; it holds an image that’s built to fail to load and the image’s error handler quietly decodes a scrambled block of JavaScript and runs it. Glance at the page source or run it past a basic scanner and you see a broken image and nothing else. The script also edits your browser history so the entry shows a short, generic /go/ link instead of the long one-time code tied to your visit and that’s why my history looked tidier than what had actually happened. It can’t touch anything outside that page so it isn’t dangerous but it does make the trail harder to retrace.
Behind that sat a second layer using the identical trick on two more domains, one named to sound like a stock-trading tool and one like somebody’s personal blog. Neither had anything on its homepage.
Where You Land Depends On What You’re Holding
I ran the chain a few dozen times presenting myself as different devices and the endings sorted neatly by platform.
As an iPhone, I landed on a fake system warning every time. Some said “This video may be not available in your country. Use a VPN to access block sites and watch videos in safe mode.” Others said “Attention! Risky network settings may affect playback. Please Install the VPN App to continue watching in safe mode.” Both had a button that opened the App Store on one of a handful of “security” and VPN apps from small companies, all published within the past year. That’s scareware in its modern form. You aren’t infected; the goal is to frighten you into installing something and apps sold this way usually lean hard on a pricey subscription.
As a Windows PC, I went through five hops and ended up on a large online retailer with an affiliate tag attached. Nobody was trying to sell me anything there, the goal was to plant a referral cookie so that if I bought something in the next few weeks, a stranger would collect a commission for “sending” me. The industry calls that cookie stuffing. Other desktop runs went to advertorials for ad blockers and to filler content sites.
I never managed to reproduce the call prompts. The ads rotate constantly, and one branch of the chain led to a domain that had already been abandoned by the time I followed it. My best guess, and it is a guess, is that my phone drew an ad that repeatedly fires tel: links to push you toward a fake support line. That’s a well-known pattern and it fits what I saw.
So Was It Malware?
Not in anything I captured. In all those runs I didn’t see any downloads, configuration profiles, browser exploits, or one of those “press these keys to prove you’re human” tricks. My iPhone also came back clean from a mobile security scan afterward.
That said, I’d still call it malicious. Everything about it is designed to deceive: the fake warnings, the hidden code, the forged referrals, the lengths it goes to so that scanners see nothing.
The cloaking matters for another reason. When I reported some of these domains, a couple of the automated checkers came back “no threats found.” Their scanners had visited the homepages from a data center, and the network showed them a blank page, exactly as it’s built to. A clean scan here only tells you the scanner wasn’t shown the scam.
How I Looked Without Getting Burned
The most common mistake people make with something like this is to keep clicking around in their everyday browser to see what happens but your everyday browser is full of your logins and saved passwords which is the last place you want to be poking at a hostile page.
I started with the things that never touch the site at all: domain registration records, DNS and hosting lookups, and public scan archives which told me who registered each domain, when, and where it’s hosted. After that I fetched the pages as plain text with a command-line tool that doesn’t run JavaScript and doesn’t follow redirects on its own so I could walk the chain one step at a time. Where the code was scrambled, I decoded it and read it rather than running it. Requesting the same address as an iPhone, an Android phone, Windows, a Mac and Google’s crawler is what exposed both the cloaking and the device targeting. I saved every response with its timestamp because a report without evidence doesn’t get far.
I did make one mistake…the tracking links this network generates include details about the visitor and a couple of responses echoed back my IP address. I didn’t strip those out of the first few evidence files I sent with reports. To be clear, the recipients were legitimate companies and the scammers already had that information, so no harm done, but if you ever do this yourself, scrub your own details before you attach anything.
Reporting It
There’s no single place to report a scheme like this. It runs on other companies’ services so you report it to each of them: the hosts running the servers, the registrars for each domain, Cloudflare where it sat in front of a domain, the affiliate network whose tracking was abused, and the blocklists that browsers check (Google Safe Browsing, Microsoft and Netcraft).
Most of those companies wanted a web form and several bounced my emails with an automated “please use our form” reply. The reports that worked were the ones that pointed at a specific abusive URL rather than a homepage, said plainly that the site cloaks and which device reproduces it, and described the behavior accurately. I called it forced redirects and deceptive scareware (not malware) because that’s what the evidence showed.
Within a few hours Cloudflare had restricted three of the domains. The rest will take longer and networks like this are designed to replace burned domains with new ones. In my experience the reports that hurt them most go to the people paying the bills, meaning the affiliate programs and app marketplaces, and to the hosts whose servers they can’t easily replace.
Apple Failed Here
The one company I couldn’t report to was the one at the end of the iPhone chain. Every one of those fake warnings funneled people into the App Store so Apple was the obvious place to start but Apple made it all but impossible as its “Report a Problem” site only lets you choose from apps you’ve already downloaded or bought. The App Store listings for these apps had no report option at all for someone who hadn’t installed them. In other words, to flag an app being pushed by fake security warnings, you’d first have to install it which is exactly what the scam wants and exactly what you’d tell anyone else not to do! I obviously wasn’t going to do that, and I’d urge you not to either.
And man, for a company that markets the iPhone on privacy and safety, it’s a frustrating gap. The people best placed to spot scareware are the ones who refused to fall for it and they’re the ones Apple gives no way to speak up.
Do better, Apple.
If It Happened To You
If all you did was visit you’re very likely fine. Don’t call any number that popped up and don’t install whatever app a warning pushed. On an iPhone, it’s worth a quick look under Settings → General → VPN & Device Management for profiles you don’t recognize, and under Subscriptions in your Apple account for anything new. Keeping iOS updated covers the rare attack that doesn’t need you to tap anything. On a computer, check your downloads, your browser extensions and which sites are allowed to send you notifications. The one situation where I’d get help right away is if a page told you to press keys or paste a command to “verify” yourself and you did it. That’s a different and more serious kind of attack.
Why I’m Telling Business Owners About This
Anyone can register a misspelling of your domain and park it. If someone has, your customers who fat-finger your address may end up exactly where I did and they’ll remember it as something that happened on the way to your site. It’s worth knowing which lookalikes of your domain exist and who holds them.
The techniques in this chain are also the ones used when an attacker takes over a small business website and starts quietly selling its visitors: targeting phones only, hiding the code, showing Google a clean page. If a customer says your site “did something weird on my phone” and you can’t make it happen yourself, take that seriously. And because your website and email usually share a domain a site that gets blocklisted for redirects can drag your invoices and quotes into customers’ spam folders along with it.
Tracing behavior that only shows up for certain visitors, collecting the evidence properly and getting it in front of the people who can act on it is something I do for clients. If your site is doing something you can’t explain or you’ve found a lookalike of your domain misbehaving, get in touch and I’ll take a look. You can also read about malware removal, security checkups and ongoing monitoring.
Frequently Asked Questions
Related Reading
-
Why Is My WordPress Site Redirecting to Another Website?
Learn how redirect malware hides from site owners and what a thorough cleanup involves. -
The Voice in the Computer: How Abandoned Hosting Accounts Become Scareware Delivery Networks
Follow another investigation into the infrastructure that turns ordinary website visits into fake security warnings. -
Hijacked Clicks: The 2025 Redirect Trap Stealing Your Visitors' Wallets
See how traffic hijacking and malicious redirects turn visitors into scam revenue. -
WordPress Malware: The Complete Guide for Small Business Owners
How WordPress sites actually get hacked, what malware does once it's in, what cleanup means, and how to tell whether the advice you're getting is sound. Written for owners who run their own site and for owners working with a developer or agency.