Devices found at Telecom Egypt demarcation points have been found to be surreptitiously redirecting Egyptian Internet users to advertisements and cryptocurrency mining sites, according to a report published by Citizen Lab at the University of Toronto Friday, March 9.
The technology research lab’s report explains that the scheme, referred to as Adhose, operates via middleboxes, computer networking devices for manipulating internet traffic. The report identifies two modes of redirection used on Egyptian citizens: “spray mode” and “trickle mode.” “Spray mode” means that a middlebox “redirects Egyptian Internet users en masse to ads or cryptocurrency mining scripts whenever they make a request to any website,” and is seemingly used “sparingly.”
“Trickle mode” means that only attempts to open certain URLs redirects users to these ads or mining scripts, specifically CopticPope.org (which was formerly the website of the Pope of the Coptic Orthodox Church of Alexandria) and Babylon-X.com (formely a porn site).
Coinhive, a Monero mining platform that positions itself to sites as an online advertising alternative, was also listed in the table of links for AdHose middleboxes to redirect Egyptian users. (( https://cointelegraph.com/news/telecom-egypt-covertly-redirecting-internet-users-to-crypto-mining-sites-report-says ))