How do I examine my iPad for malware?

I have not heard of any exploit that would produce this behaviour.

The fact that the pages DO load, and only switch to another page AFTER they have loaded, indicates to me that the problem lies within the page itself. For instance some "evil" Javascript is inserted into the page causing it to redirect.

If the problem was in the OS, for instance messing with DNS, I would expect that you would never be able to reach the page and you would immediately be getting the "evil" page.

Ad networks have often been used for this kind of abuse because there are many parties providing content for ads, so it is hard to check everything that goes on. I would think that an evil advertisement is much more likely to be the cause of this problem than any malware on your iOS device.

You could try using your iPad via proxy and monitor the traffic that comes through. You could set your computer to share its internet connection over Wifi, and run a html proxy on your computer. And then look in the transferred code to see if you can identify the cause of the redirects.


If your device is not jailbroken the odds of malware on iOS are basically 0, at least for what you're describing. There is currently no way anything could be installed without going through the App Store. Even then, a malicious app could only access its own files in its own sandbox. So, no installed app on iOS could modify anything outside of it.

This is also why you won't find any app scanning your iPad for malware. A malware scanner would need access to all system files but no app on iOS could do that (except for Apple's own apps).

This sounds more like a problem made by the particular websites themselves.


Sure sounds like something with the target websites. You could install Wireshark on a laptop with wi-fi, monitor your traffic when you visit the site and see what happens. You could then do the same from another (working) machine and see if the same HTTP messages are sent/received.

Also, now that Chrome is out on the iPad, you could try that to see if it behaves differently.