r/computerviruses • u/Quick-Birthday5852 • 3d ago
File / URL Check previously safe link redirected me to a strange link and then ddos-guard - am i alright?
hello,
i was on twitter and i saw a discussion about youtubers merch, so out of curiosity in the twitter search i looked up the name of the youtube series shop and clicked onto a tweet from one of the youtubers who posted the shop link back in 2023.
i assumed they still owned the domain and i clicked it and the page was loading for a bit which happens sometimes. i closed out and reclicked it and it brought me to a ddos-guard page. this freaked me out (i have never seen this before) i also noticed very briefly before the url swapped to what lead to the ddos-guard page, it said "hxxps://hppymel(dot)com". i had clicked on a link that was "hxxps://lifeseries(dot)shop" (before it redirected me)
here is the virus total link : VirusTotal - URL
it has it marked as phishing and aside from two suspicious claims, not much else for information. i did not enter any personal data - my biggest concern is i was barely paying attention until the ddos-guard page popped up and being on autopilot i feel like i saw a pop up briefly pop up on the corner asking about permissions and i dont know if i clicked something or what (stupid of me, i know). my web browser settings havent marked anything as me allowing permissions but i also know it is not that simple.
when i search the website online, all i found is people saying they were getting a pop up adware directing them to the site? which isn't what my case was.
in general, im asking if this is worth my massive concern. what should my next steps be if anything aside from antivirus scan? im very nervous. i certainly have learned a lesson here. i'm not technologically inclined beyond very basics and i want to be safe.
thank you.
1
u/ThreeCharsAtLeast 3d ago
Web browsers are designed in a way that websites can do no harm by themselves. Sure, they can ask for extra permissions or trick you into doing something (running an executable or a command, handing away your personal information, calling a scammer etc). If your browser was up-to-date, this is all you need to check for as this is not the setup where spear phishing is probable.
Open your browser settings and look for the permissions page. See if any site in the redirection chain has any permission and revoke them. You may find this listed as “exception”. Weird websites especially like the notifications permisson to send you notifications such as this one. What you're looking at is a site-specified image with the whole “system error” thing as part of a notification with a text specified by the websites and buttons set by the site, too. “Via Microsoft Edge” and the URL that's in the redacted part of the screenshots give away that this is malicious. Clicking on most of this would open a website that would convince you to run a virus. If you have one of these, you can revoke the permission by clicking on the three dots.
Many malware campaigns right now involve fake captchas that tell you to paste commands somewhere, mostly into the Windows run dialog. Press Windows + R and look at the command in the box. The dialouge keeps a history and you can view it if you click the arrow icon. What you're looking for is a long, weird command. Most have a section at the very end designed to hide the actual command and show a nice message about verification or whatever if you put your cursor at the very end. Some variations ask you to use the terminal instead. Open PowerShell, wait for
PS [some path]>to appear and press arrow up. This shows the last command you ran. You can use arrow up / down to go through your PowerShell history. Unfortunately, this doesn't exist for CMD.