Often being outside the home region, I have to work through the mobile Internet for my work. And now, for the second time, I notice that, as the mobile Internet operator on the Internet resources blocking page banned in the territory of the Russian Federation, it places not only ugly black words about blocking a resource. I definitely don’t remember what happened the first time, but definitely something related to paid subscriptions, forcing to call and unsubscribe. Then I spoke with the support of Tele2, which they advised me to check the PC for the presence of malware, and disowned this problem. But this time I decided to fix this fact for the purpose of further study, in order to understand something on whose side the problem is, and if it is authorized by the operator, then it is human, and possibly by law, bad, given Tele2’s policy of the absence of hidden fees and other things, to expose your client to unnecessary risks.
The scenario is something like this: on the blocking page, a block is inserted with a link to a third-party resource on cloudflare, when clicking on it, there is a 302 redirect to the target site with binary options.
Just in case, I recorded all the IP addresses and whois information at the time of the incident.
Screenshots and voting under the cut.
Resource page with ad insertion')
Learning page lock 1Learning page lock 2Learning page lock 3Javascript in the code page lockt2rkn.com http transition in the browser302 redirect from rk.represenrate.com to optionsAfter clicking on the link to optionsMy ipnslookup t2rkn.comwhois by ip (nslookup t2rkn.com)nslookup rk.represenrate.comwhois by ip (nslookup rk.represenrate.com)whois t2rkn.comwhois represenrate.comI suggest you participate in the survey and leave comments below.