Survey.[RANDOM NUMBER].ws

Security researchers alert that Web surfers that use to click on suspicious ads and click-bait links may be presented with content from domains named Survey.[RANDOM NUMBER].ws. We have received reports that advertisers and adware developers use pages registered to the 45.79.206.139 IP address to claim pay-per-click revenue and promote riskware. You may experience pop-up windows loaded with content from Survey.[RANDOM NUMBER].ws, which claim to provide search functionality while the following message is displayed on your screen:

'Search whatever you are looking for!
[text box that says 'Enter Your Email'] Submit Email to Continue'

The message is not accompanied by a company logo and information as to who owns the Survey.[RANDOM NUMBER].ws domains. The lack of ownership information should make you cautious and pay attention to what Survey.[RANDOM NUMBER].ws has to offer. If you look at the URL bar of your browser, you may notice that the address looks like Survey.746.ws followed by a long string of random characters. Web surfers that enter their email address in the fields provided at Survey.[RANDOM NUMBER].ws may be rerouted to a custom version of Google and Yahoo. Custom search engines powered by Google and Yahoo may be tailored to load ads from sponsors to Survey.[RANDOM NUMBER].ws and include offers to install riskware. AV vendors are known to detect software related to Survey.[RANDOM NUMBER].ws and display security alerts that contain the following tags:

• Shopperz (fs)
• Adware.PerinetCRTD.Win32.126
• PUA.Toolbar.BitCocktail
• PUA/Vbates.311096.1

Security experts advise against loading resources hosted on Survey.[RANDOM NUMBER].ws. Pages like Survey.[RANDOM NUMBER].ws may be compromised relatively easily, and there is a chance that users are exposed to scripts used with the Infinity Exploit Kit. You may want to navigate to the Help section in the menu of your browser and make sure you are running the latest version of your favorite Internet client. Pop-up windows by Survey.[RANDOM NUMBER].ws may be equipped with a JavaScript that exploits vulnerabilities in older versions of Google Chrome, Opera, Mozilla Firefox, Internet Explorer and Edge. You may want to consider using a trusted anti-spyware tool to scan your PC for programs that generate Web traffic to Survey.[RANDOM NUMBER].ws and have them removed safely.