Pop ups in Chrome trying to have me install an application, how to find the root cause? Recently I have seen a lot of these:

This is not the typical "fake pop up" trying to have you tap on it and redirect you to the Play Store. This pop up actually replaces the tab I'm browsing, and is trying to have me go to the play Store to install one specific app. 

Everything in this phone comes from the official Play Store, and the phone is not rooted.

For SEO sake, here are the domains used in this scam: 

eu.sustainable-49.xyz
samsung.giveaway-deal-com.xyz
us.east-85.xyz

Here are a few screenshots:

The text basically says that my phone is infected and I NEED to install those applications, or that I have won something and I need to something (I didn't follow in that case..)









In one case, this leads to this application, which contains this comment (from yesterday):




Hi, thanks for your feedback. We’ve found that some ads/redirected pages may be malicious promotion from unknown channels, slandering us on purpose. Would you please be so kind that next time you come across the pop-up ads, please send us the link/spam/redirect pages or a screenshots to our Email: cleaner@duapps.com. Thanks a million.

I'm not sure whether this is a local attack on my smartphone, ie an app which would somehow mess with Chrome, inject some code in the pages, or an attack on those websites, or a compromised ad network. It's a bit hard to tell exactly when this is happening.

Could you suggest a method to capture this behavior next time it happens so that I can understand why this is happening ?

Here is one example: 

1/ click on Google search result 
2/ now I am on some domain on forum-actif.net
3/ redirect to android.earix.com
4/ some data containing this url: go.onclasrv.com/afu.php?...
5/ redirect to onclickads.net
6/ us.east-85.xyz -&gt; virus notifications leading to some Play Store App


Another example

1/ m.wikipedia.org
2/ orange.com-getprize.net



1/ bfmtv.com (French news TV website)
2/ redirect to eu.sustainable-49.xyz/fr002rd/redirect.html?model=Nexus%205&amp;brand=Google&amp;browser=Chrome


This leads me to think that the attack could be from a malicious app on my smartphone, because there is no way this is happening because of a compromised ad network on wikipedia.org.
Cause of your problem is probably:


DNS injection in your network (check other devices, try setting DNS to 8.8.8.8 / 8.8.4.4)
Man in the middle attack in your network (check other devices, try enabling Data saving in Chrome settings)
weird unknown Chrome data corruption - try going to Settings->Applications->Chrome->Clear data &amp; Clear cache
Google Ads script injection - try disabling ad personalization as described in provided link
virus - use Malwarebytes Antimalware for Android


You can try:


using other browser
entering sites with HTTPS - try for example typing https://new.google.com/


EDIT: How to capture redirections using Chrome Developer Tools?


download Google USB Drivers &amp; ADB on your PC
plug your phone in
run adb devices, it should say your device is unauthorized
on your phone, you will get a window, select "Always trust this computer" and Yes
open Chrome on both your PC and phone
on PC, open Developer Tools on any page (f.e. about:blank)
select (hamburger)->More tools->Inspect devices...
make sure USB is checked
your device should appear on the left
run https://www.google.com on your phone (or any other working site)
on PC click on your device and select Inspect on your working tab
go to Network tab and select Preserve log checkbox
select Doc tab
navigate on your phone and see every HTML document your browser loads (it sometimes may go to Other tab)