Odds are still quite high it is some browser hijacker in your phone, and not subsim. The more sneaky ones will only target a handful of the sites that you use the most as a way of disguising their presence, so that people think it is the site doing it and not malware on their computer/device.
try googling "crobo malware"
|