Suspicious redirect on iOS

Infected operating system
iOS
Infected device
iPhone 7
Infected device issues
  • Webpage (campus) redirects to a different website (fjorist.ru and then to approx. 10 otger websites)
  • Only happens when google searched, but not when directly searched by campus.ee from the search bar
  • Happens only once per web-session
  • Happens on all the devices connected to the same network
Steps taken to remove the infection
I have tried:
  • hard resetting the system (but with a back-up that basically saved everything, even settings)
  • deleting browser cache, cookies and data
  • accessing the webpage on three different phones and a PC (still redirects), all on the same network
  • contacting the webpage administrator with no avail
  • since the iOS doesnt support any anti-malware programs, I have not used any
K

Kesine Mees

New Member
Thread author
Jun 29, 2022
3
0
1
Since the month of June, I have noticed a weird phenomena. More specifically, I get a one-time redirect website (fjorist.ru) when clicking on the first google search campus. The important part is that the redirection occurs once per web session and only with the site mentioned above. That means, as I close the browser and reopen it, the problem still persists.
 
I suspect the DNS address on your router is hijacked. Use a secure dns service like Nextdns on all your devices. Reset your router, check whether your router has any firmware updates, if so update it. Change its default admin password. Change the DNS server address of your router to something secure like quad 9 or nextdns.

easysolvemalware.com

How to Remove Fjorist.ru Redirect? - EasySolveMalware.com

Fjorist.ru is identified as browser hijack virus. Once infiltrates into your PC, Fjorist.ru begins to take over the browser. Usually Fjorist.ru comes along
easysolvemalware.com
 
  • Like
Reactions: Back3
Thank you for your reply. I tried the above - my DNS seems not to be compromised. As well as my router password, I have computer generated password for my router admin page, and a different one for the wifi. The problem was actually on their own website - it was compromised after all.

Best, Kesine
 

You may also like...