All Devices Strange download pop-up (index.html). Bug or Malware?

[revmacian]

Good question, but I am not using an adblocker (and no extensions in Safari).

Yes, that's my point, I don't see any of the issues that others are seeing with malicious advertisements because I run an adblocker. And, the reason I run an adblocker is because the advertisement system is broken and dangerous to website visitors. I'm wondering if this index download popup is due to a malformed advertisement.

 

[morggan1]

This is very annoying. It happens when I read some newspapers. I'd like to attach the file here but can't see the way to do that with the attach butto (only accepts pdf or jpg)
[automerge]1581408126[/automerge]

Seems widespread. Doesn't necessarily seem like malware though.

Can you email me the index.html file? arn@normalkid.com

I'm sending you the file by email
[automerge]1581408409[/automerge]
Just FIY I am using a MacBook Air with Safari 12.1.2

 

[arn]

This is very annoying. It happens when I read some newspapers. I'd like to attach the file here but can't see the way to do that with the attach butto (only accepts pdf or jpg)
[automerge]1581408126[/automerge]

I'm sending you the file by email

Thanks!

Yep, it looks like ad code in it. So some config issue apparently. Is it still happening on this site? If so, sending me that particular index file will help track it down when I send it to our ad network.

arn

 

[morggan1]

Thanks!

Yep, it looks like ad code in it. So some config issue apparently. Is it still happening on this site? If so, sending me that particular index file will help track it down when I send it to our ad network.

arn

Just emailed the file to you, thanks.

 

[Jeff Gee]

i noticed it’s a dark color near the address bar meaning you’re in incognito mode? I recently switched mine to private browsing and i’m getting the same pop ups. could be related?

 

[arn]

Just a reminder. If anyone gets an index.html download on MacRumors.com -- let me know and send it to me. I can followup with our ad network in that case.

 

[Ruggy]

Could it by any chance be connected to using 'reading list'?
If you've bookmarked a site for the reading list, it will try to download the page for offline reading.

 

[acont]

Hello, I am experiencing a similar thing. Every time I open a certain website (https://vietnamnet.vn/en/ or https://e.vnexpress.net) a html file is being downloaded automatically. It's called 300x250.html. I have since then changed Safari settings to ask for location when a download is starting to precent the automatice saving. Attached are screen shots of the download request and the file (I cannot attach a html file with my post).

I have used Avast and Malwarebytes without any success of finding anything unusual. I'm running Mojave 10.14.6 on an iMac.

Thanks for any help wether this is a malicious file and how to get rid of this.
Steve

 

[arn]

Hello, I am experiencing a similar thing. Every time I open a certain website (https://vietnamnet.vn/en/ or https://e.vnexpress.net) a html file is being downloaded automatically. It's called 300x250.html. I have since then changed Safari settings to ask for location when a download is starting to precent the automatice saving. Attached are screen shots of the download request and the file (I cannot attach a html file with my post).

I have used Avast and Malwarebytes without any success of finding anything unusual. I'm running Mojave 10.14.6 on an iMac.

Thanks for any help wether this is a malicious file and how to get rid of this.
Steve

it seems just a misconfigured ad.

 

[stephenWa]

Hi arn,

I am also experiencing the same issue on my iphone Safari (ios 13.4.1). Two html files were downloaded. When I opened them in browser, they are blank. I opened them in notepad++ and saw some html codes. Sorry, I don't understand any html. Would you please let me know if they look suspicious... I've sent them to your email address above.

Thanks a lot in advance!

Stephen

 

[stephenWa]

Sorry. Please delete. Thanks!

 

[FlyingDutch]

Hello, I am experiencing a similar thing. Every time I open a certain website (https://vietnamnet.vn/en/ or https://e.vnexpress.net) a html file is being downloaded automatically. It's called 300x250.html. I have since then changed Safari settings to ask for location when a download is starting to precent the automatice saving. Attached are screen shots of the download request and the file (I cannot attach a html file with my post).

I have used Avast and Malwarebytes without any success of finding anything unusual. I'm running Mojave 10.14.6 on an iMac.

Thanks for any help wether this is a malicious file and how to get rid of this.
Steve

same issue here, with a file called 970x250.html ...

It seems to be an ad.
I don't understand why Safari is actually DOWNLOADING the file.

 

[arn]

yeah... seems to be a misconfigured ad.

 

[ijm8710]

yeah... seems to be a misconfigured ad.

arn, I’m getting this all the time, not necessarily on this site but in general surfing safari (and have reproduced in other browsers)

Is it a site issue (site needs to fix ad issue)

or is it an Apple issue (I’ve only seen this issue for ~1.5 months but it’s gotten progressively worse as I’ve jumped on more recent betas)

I see it most commonly on amp and news sites (live science businessinsider and Washington post were the most recent 3)

basicallY wondering since it seems you’ve done a cursory analysis on it iF I should keep reporting beta feedback Or if we should be emailing each site individually to ask to fix and what best to ask of them

thanks, hope you have a little to share

 

[arn]

I’m not entirely sure but I think it’s reasonable to continue to send bug reports from safari.

My guess is it doesn’t happen on chrome which is more common a browser for the ad networks to test on, which is prob why its happening as much as it is.

 

[ijm8710]

I’m not entirely sure but I think it’s reasonable to continue to send bug reports from safari.

My guess is it doesn’t happen on chrome which is more common a browser for the ad networks to test on, which is prob why its happening as much as it is.

It’s gotten to the point where I’m seeing it 20x a day, but I only really surf on mobile
One user said this may relate to sandbox flag allow-downloads-without-user-activation

I just don’t know the chances aplle even sees for the feedback assiatant unless more people report.