URLs hijacked by kali.shp.mcafee.com

[lonecoldfnord]

I am not a McAfee customer, but am finding URLs are being redirected to your service.

In one instance, https://newsletter.danhon.com/ is redirecting to http://blockpg.kali.shp.mcafee.com/blockpage/?ref=f4fa56a0cdbb2062e830000f5258089e.

In another instance teamsnap.com - a site that is not malicious - was blocked.

I have not been able to track down how McAfee is inserting itself into my connection:

• The router on my home network doesn't reference it in any setting
• My ISP says they do not use McAfee
• McAfee is hijacking more than one browser on my laptop, so it is not a browser setting
• No system preference on this OS X machine references any McAfee service
• I am not now and have never been a user of your antivirus products

[GaneshR]

Hi @lonecoldfnord 

Greetings from McAfee!

We have raised a ticket to the concern team. Please check after 3 - 5 working days. We will keep you posted on the updates.

Regards,
Ganesh Raju R

[lonecoldfnord]

Thank you.

I have more information: the domain redirect happens from a different computer.

1. The issue usually happens on my Macbook.

2. I opened a Chromebook and connected to the same wifi network

3. I went to the affected link reported above, at newsletter.dahon.com

4. I was redirected to kali.shp.mcafee.com

[lonecoldfnord]

For debugging I tried the same workflow but with a different wifi access point. The issue only occured when using a particular device, a COVR-2200, a D-Link device.

I then explored the configuration options for the COVR. There was definitely no setting to enable or disable McAfee.

I believe that what is happening is in the firmware because of a contractual relationship between D-Link and McAfee.

[lonecoldfnord]

Another URL blocked by mcafee is:

https://accounts.youtube.com/

This could not be more plainly wrong. There's no question the blocklist is actually reliable enough to occupy such a privileged position in my network.