[USML Announce] OnRoto Malware/Redirect

[Mark Blocker]

I have not seen this, but will look into it next week.

Mark B.


On Fri, May 22, 2026 at 2:22 PM Klein Nine via Announce <announce at usml.net>
wrote:

> Nothing here, though I do use a pop-up blocker.  Maybe it's aimed at those
> using AOL addresses. :)
>
> -Andy
>
>
> -------------------------------------
> Owner, Klein Nine (est. 1990)
>
>
> On Friday, May 22nd, 2026 at 12:20 PM, springkerb--- via Announce <
> announce at usml.net> wrote:
>
> What's the appropriate email address to send to? Any benefit to be had by
> sending complaints to the Illinois AG's consumer fraud bureau? (Illinois is
> generally a fairly aggressive state in terms of privacy and info sec
> issues.)
>
> Mark K
>
> On Friday, May 22, 2026 at 11:06:34 AM CDT, Jeffrey Winick <
> jwinick at hwhlegal.com> wrote:
>
>
> FWIW, I’ve already sent an angry gram. No response.
>
> Jeffrey H. Winick
> Harris Winick Harris LLP
> 333 West Wacker Drive
> Suite 2060
> Chicago, Illinois 60606
> Tel: 312-662-4600 | Fax: 312-662-4599
> Direct: 312-62-4602 | Cell: 312-841-2817
> www.hwhlegal.com | jwinick at hwhlegal.com
>
>
> ------------------------------
> *From:* Announce <announce-bounces at usml.net> on behalf of springkerb---
> via Announce <announce at usml.net>
> *Sent:* Friday, May 22, 2026 11:03:52 AM
> *To:* USML Announcements <announce at usml.net>
> *Cc:* springkerb at aol.com <springkerb at aol.com>
> *Subject:* [USML Announce] OnRoto Malware/Redirect
>
> Wondering if the rest of you have seen an annoying uptick in a malicious
> pop-up on the onroto site. It's a redirect to a fake McAfee warning
> message, including the usual dire warning about malware (and of course
> directions to click on something to subscribe to McAfee). As I understand
> it, there are also versions mocked up for other security software (e.g.,
> Norton). It's absolutely clear to me that it's coming from onroto.
>
> I assume you're all savvy enough not to click. However, it's getting
> really annoying. I've tweaked up everything I can think of--pop-up blocker,
> security settings, etc., but that doesn't seem to be enough to ward it off.
> This morning, I had to close onroto three times in the course of about five
> minutes.
>
> From what I understand, the problem is that onroto sells advertising to
> some sketchy advertisers. Their ads implement the redirects regardless of
> whether you click on them.
>
> So, for all--beware. And for Mark B, is it worth sending an annoyed note
> to onroto? One annoyed note won't make them do anything, but perhaps
> they're getting similar messages from others. And, since they have a new
> owner, perhaps there's an opportunity to nudge them in the direction of
> cleaning up their mess.
>
> Thanks.
>
> Mark K
>
>
> _______________________________________________
> Announce mailing list
> Announce at usml.net
> http://usml.net/mailman/listinfo/announce_usml.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://usml.net/pipermail/announce_usml.net/attachments/20260523/6db63bef/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image1779477667029
Type: image/png
Size: 6382 bytes
Desc: not available
URL: <http://usml.net/pipermail/announce_usml.net/attachments/20260523/6db63bef/attachment.png>