Safari redirecting occasionally to sponsor.adverstitial.com Recently Safari has been exhibiting an odd behavior - I'm in the middle of browsing something and suddenly the entire page is redirected to a sponsor.adverstitial.com URL.

In searching online I see mention of people from many different forums begin redirected there, so it seems like a problem not related to websites I am on, but more like malware of some kind.

Does anyone know what is causing this?

Some steps I've taken include:


I've carefully poured over the process list with ps -efww to see if I have any processes I do not recognize.
I've also gone into my startup items to see if anything looks suspicious, just a few items that I know what they are.
As I said, carefully searched the internet for causes but can find only victims, not solutions.
Looked into Safari Extensions - I have only ClickToFlash and "Translate" from SideTree.com installed.  I tried disabling Translate and will see if it happens again.


For the moment I've taken the precaution of changing the IP for sponsor.adverstitial.com to be just localhost in /etc/hosts so at least my browser does not actually load the site, but the redirect still occurs (just with a blank page).  Obviously whatever causes the redirect could be sending out other info, so I'd really like to find the root cause and eradicate it.
I left Charles (web proxy debugger) running and waited for the re-direct again.  I found the site that is originating the request to sponsor.adverstitial.com, it is ad.cpmaxads.com.

A request to that site goes out, then it brings back a lot of shady looking javascript/HTML mix with this in the middle:

{var v=Math.floor((Math.random()*100000));setTimeout(function(){try{window.top.location.href="http://sponsor.adverstitial.com/view/advertisement?loc="+v+"&amp;adv="+p+"&amp;camp="+o+"&amp;w="+t+"&amp;h="+B+"&amp;rnd=4878995824626992114"}catch(d){}},2000)}}


The request to ad.cpmaxads.com from the web page was:

GET /audience/campaign?adid=2832800&amp;cpid=657304&amp;w=728&amp;h=90&amp;rn=1397433511&amp;ct=http://clk.specificclick.net/click/v=5%3Bm=3%3Bl=12679%3Bc=657304%3Bb=2832800%3Bts=20140413195831%3Bui=9BHmMkGDmpd5VsqEQpYbPNeNVqvOhgeY_JYZTk4np7i31BriQpt2BAVz7vpcD5rKAI1kfLriLvqflWaNGuBRQA%3Bdct= 


And the referring page was from Slashdot.org.

I'm pretty sure now this is specifically an advertisement that manages to force the whole page to load a new URL, as you can kind of make out from the Javascript - so at least it's not malware.  I'm going to try setting a /etc/hosts entry as follows to block the origin of the offending Javascript:

0.0.0.0 sponsor.adverstitial.com
0.0.0.0 ad.cpmaxads.com


As it comes from advertising, this probably occurs for any other sites using that advertiser.  If people are not comfortable editing /etc/hosts, you could also try installing an ad-blocker, and just blacklisting ad.cpmaxads.com if you didn't want the whole ad-block experience (I don't like how it slows things down and I do want to support sites I like with advertising revenue - as long as ads do not infuriate me be repaving the whole page...)

For those interested in the whole HTML/javascript block that comes back from ad.cpmaxads.com, it is:

&lt;!DOCTYPE html&gt;
&lt;html&gt;
&lt;head&gt;
    &lt;meta http-equiv="X-UA-Compatible" content="IE=edge" /&gt;
    &lt;meta http-equiv="expires" content="0"&gt;&lt;meta http-equiv="Pragma" content="no-cache"&gt;&lt;meta http-equiv="cache-control" content="no-cache"&gt;
&lt;/head&gt;
&lt;body&gt;

&lt;div id="adarea" style="position:absolute; top:0px; left:0px; width:300px; height:250px;"&gt;
    &lt;!-- default --&gt;
    &lt;!-- end default --&gt;
&lt;/div&gt;

&lt;img src="http://s.viewalytics.com/t/e?p=52&amp;t=7&amp;ev=1&amp;asrc=0&amp;site=0&amp;rnd=0" width=1 height=1 border=0 style="position:absolute; top:-4px;"&gt;

&lt;script type="text/javascript"&gt;
function getParameterByName_fromURL(b,f){try{b=b.replace(/[\[]/,"\\[").replace(/[\]]/,"\\]");var a="[\\?&amp;]"+b+"=([^&amp;#]*)";var d=new RegExp(a);var c=d.exec(f);if(c==null){return""}else{return decodeURIComponent(c[1].replace(/\+/g," "))}}catch(g){return""}}var placement_oo="1";var placement_lo="1";(function(){function H(f,w){try{f=f.replace(/[\[]/,"\\[").replace(/[\]]/,"\\]");var d="[\\?&amp;]"+f+"=([^&amp;#]*)";var r=new RegExp(d);var h=r.exec(w);if(h==null){return""}else{return decodeURIComponent(h[1].replace(/\+/g," "))}}catch(J){return""}}function C(e,d){var f=document.getElementById("adarea");if(f){if((e==728)&amp;(d==90)){f.style.width="728px";f.style.height="90px";f.innerHTML='&lt;iframe width=728 height=90 border="0" frameborder="0" marginwidth="0" marginheight="0" topmargin="0" leftmargin="0" hspace="0" vspace="0" scrolling="NO" src="http://ad.cpmaxads.com/audience/default/default_728_90.html"&gt;&lt;/iframe&gt;'}else{if((e==300)&amp;(d==250)){f.style.width="300px";f.style.height="250px";f.innerHTML='&lt;iframe width=300 height=250 border="0" frameborder="0" marginwidth="0" marginheight="0" topmargin="0" leftmargin="0" hspace="0" vspace="0" scrolling="NO" src="http://ad.cpmaxads.com/audience/default/default_300_250.html"&gt;&lt;/iframe&gt;'}else{if((e==120)&amp;(d==600)){f.style.width="120px";f.style.height="600px";f.innerHTML='&lt;a href="http://www.stjude.org/moments?sc_cid=bnn103"&gt;&lt;img src="http://ad.cpmaxads.com/audience/default/psa/120x600.gif" width="120" height="600" border="0"&gt;&lt;/a&gt;'}else{if((e==160)&amp;(d==600)){f.style.width="160px";f.style.height="600px";f.innerHTML='&lt;iframe width=160 height=600 border="0" frameborder="0" marginwidth="0" marginheight="0" topmargin="0" leftmargin="0" hspace="0" vspace="0" scrolling="NO" src="http://ad.cpmaxads.com/audience/default/default_160_600.html"&gt;&lt;/iframe&gt;'}else{f.style.width="300px";f.style.height="250px";f.innerHTML='&lt;a href="http://www.stjude.org/moments?sc_cid=bnn102"&gt;&lt;img src="http://ad.cpmaxads.com/audience/default/psa/300x250.gif" width="300" height="250" border="0"&gt;&lt;/a&gt;'}}}}}}var p;var o;var t;var B;var l;try{p=H("adid",window.location.href)}catch(D){p=0}try{o=H("cpid",window.location.href)}catch(D){o=0}try{t=H("w",window.location.href)}catch(D){t=0}try{B=H("h",window.location.href)}catch(D){B=0}try{l=H("ct",window.location.href)}catch(D){l=""}C(t,B);function i(r,K,h){var J=new Array();J[0]="0";J[1]="0";J[2]="0";try{var d=r.indexOf(" ",K+h);if(d==-1){d=r.length}var f=r.substring(K+h,d);if(f.indexOf(".")&gt;0){J=f.split(".");if(!J[0]){J[0]="0"}if(!J[1]){J[1]="0"}if(!J[2]){J[2]="0"}}}catch(w){}return J}var G=false;var b=0;var k=0;var c;try{c=navigator.userAgent;if(!c){c="unknown"}c=c.toLowerCase();if(c.indexOf("msie")&gt;0){b=1}else{if(c.indexOf("chrome/")&gt;0){b=2;G=true}else{if(c.indexOf("safari/")&gt;0){b=3;G=true}else{if(c.indexOf("firefox/")&gt;0){b=4;G=true}else{if(c.indexOf("trident/")&gt;0){b=7;G=true}}}}}if(c.indexOf("windows")&gt;0){k=1}else{if(c.indexOf("macintosh")&gt;0){k=2}}}catch(D){}var s=0;try{if(b==1){var q=i(c,c.indexOf("msie"),5);s=Number(q[0]);if((s==8)||(s==9)||(s==10)){G=true}}}catch(D){}function j(){var f;try{if(typeof document.hidden!=="undefined"){f="hidden"}else{if(typeof document.mozHidden!=="undefined"){f="mozHidden"}else{if(typeof document.msHidden!=="undefined"){f="msHidden"}else{if(typeof document.webkitHidden!=="undefined"){f="webkitHidden"}}}}}catch(r){}var e=0;if(f){try{if(typeof document.addEventListener!="undefined"&amp;&amp;typeof f!="undefined"){if(document[f]){e=2}else{e=1}}}catch(h){e=0}}return e}var u="true";var a=j();if(!a){a=0}var m=false;try{var n=document.location.href;var g=document.referrer;if((n.indexOf("delta")&gt;0)&amp;&amp;(n.indexOf(u)&gt;0)){m=true}if((n.indexOf("11526")&gt;0)||(n.indexOf("42823")&gt;0)){m=true}if((g.indexOf("delta")&gt;0)&amp;&amp;(g.indexOf(u)&gt;0)){m=true}if((g.indexOf("11526")&gt;0)||(g.indexOf("42823")&gt;0)){m=true}}catch(E){}if((p&gt;0)&amp;&amp;(o&gt;0)&amp;&amp;(G==true)&amp;&amp;(a!=2)&amp;&amp;(k&gt;0)){if(((t==728)&amp;(B==90))||((t==300)&amp;(B==250))||((t==120)&amp;(B==600))||((t==160)&amp;(B==600))){try{if((window.location.protocol=="http:")&amp;&amp;(m==false)){var v=Math.floor((Math.random()*100000));setTimeout(function(){try{window.top.location.href="http://sponsor.adverstitial.com/view/advertisement?loc="+v+"&amp;adv="+p+"&amp;camp="+o+"&amp;w="+t+"&amp;h="+B+"&amp;rnd=4878995824626992114"}catch(d){}},2000)}}catch(E){}}else{}}else{var y=t;var x=B;if((a==2)&amp;&amp;(placement_oo=="1")){var I="http://ad.cpmaxads.com/audience/default/psa/default.swf?width="+y+"&amp;height="+x+"&amp;rn="+Math.round(Math.random()*100000000);var z=navigator.userAgent.toLowerCase();var A="";if((z)&amp;&amp;(z.indexOf("msie")&lt;0)){A='&lt;object style="position:absolute; top:0px; left:0px; display:block; line-height:0px; margin:0; padding:0;" id="defaulted_banner" name="defaulted_banner" type="application/x-shockwave-flash" data="'+I+'" width="1" height="1"&gt;&lt;param name="movie" value="'+I+'"/&gt;&lt;param name="quality" value="low"/&gt;&lt;param name="bgcolor" value="#808080"/&gt;&lt;param name="play" value="true"/&gt;&lt;param name="loop" value="false"/&gt;&lt;param name="wmode" value="window" /&gt;&lt;param name="allowScriptAccess" value="always" /&gt;&lt;param name="hasPriority" value="true"/&gt;&lt;/object&gt;'}else{if(z){A='&lt;object style="position:absolute; top:0px; left:0px; display:block; line-height:0px; margin:0; padding:0;" id="defaulted_banner" name="defaulted_banner" classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" width="1" height="1"&gt;&lt;param name="movie" value="'+I+'"/&gt;&lt;param name="quality" value="low"/&gt;&lt;param name="bgcolor" value="#808080"/&gt;&lt;param name="play" value="true"/&gt;&lt;param name="loop" value="false"/&gt;&lt;param name="wmode" value="window" /&gt;&lt;param name="allowScriptAccess" value="always" /&gt;&lt;param name="hasPriority" value="true"/&gt;&lt;/object&gt;'}}if(A){var F=document.createElement("div");F.style.position="absolute";F.style.top="4px";F.style.left="4px";F.style.margin="0";F.style.padding="0";F.style.zIndex=2147483647;F.innerHTML=A;try{document.body.appendChild(F)}catch(E){}}}}})();
&lt;/script&gt;

&lt;/body&gt;
&lt;/html&gt;