Wiggleraway

I just had a look back at this. The problem is an exploit on google-analytics. The modification to the webpage is performed using a specially crafted malicious analytics config by DRP.su to specifically target the SDI tools website. Any ad blocking program or browser with rules to disable google analytics will stop the malicious script from running and get the original webpage. The whole thing is bizarre. Samlab has admitted he creates the dodgy DRP.su software, he clearly has access to the SDI website...

I just had a look back at this. The problem is an exploit on google-analytics. The modification to the webpage is performed using a specially crafted malicious analytics config by DRP.su to specifically target the SDI tools website. Any ad blocking program or browser with rules to disable google analytics will stop the malicious script from running and get the original webpage. The whole thing is bizarre. Samlab has admitted he creates the dodgy DRP.su software, he clearly has access to the SDI website...

It appears the problem is a dodgy script on the website redirecting traffic. The DOM on https://sdi-tool.org/download/ is modified to change the links from SDI lite to a program called Driverpack from drp.su. It links to htt#p://dl.drp.#su/17-online/DriverPack-17-OnlinefromSDI-tools.exe (hashes added to stop accidental clicks and any google linkbacks).