Why does the first opening of the site redirect to advertising?

Question

Drupal

Hello.
There is a site that immediately shows a page with advertising on the first transition. The second time you click go to the site, it enters without problems.
The screen of the advertisement itself:

What could be the reason for this? Maybe the problem is in the local browser, where the script (in the cache) intercepts the transition of the site and is ahead of its ads? This problem is not only on my computer and appeared about 3 months ago.
Where to dig?

Answer 1

see the server
headers: there immediately redirect to gooldire.ga/index/?1631404756613
start with the logs - you see them there or not, etc.

Answer 2

I think it's viruses

Answer 3

judging by the fact that ads are shown only the first time, even if you go incognito a second time, the choice of who to show ads to is based on the ip address, and not cookies / local storage / session. It means to dig in the direction of the hoster or malware on the site itself, the second is less likely, since you need to store IP addresses somewhere and quickly transfer the missing ones to advertising. It's possible, though, so check for files with recent modification dates, eval, base64decode, and other odds. And check the hoster, write to the support.