For unknown_html_RFI_php, see: http://urlquery.net/report.php?id=15135 (safe??)
See code: -http://jsunpack.jeek.org/?report=0d68a559c2a3795739d2cde66be9549d1708087f
Go there if security savvy, with ample script protection and in a VM,
Sucuri finds this malware as: Malware found in the URL:
-http://eaglehealth.com/pbot.txt
Known javascript malware.
Details: http://sucuri.net/malware/entry/MW:JS:GEN2
Avast webshield alerts to this with JS:Illredir-AQ[Trj]
See: https://new.virustotal.com/url/60e98658ac8b6133c85d7702702ce5687a41eb92f6c37ab7e481faf7ed332e60/analysis/1326044281/
Not detected here: http://www.virustotal.com/file-scan/report.html?id=14d3cc2adc5dd925c124104ebc612c9857038a3709973c55b93a4abd28cf508f-1325979173
and here:
http://vscan.urlvoid.com/analysis/426ec145e46e6038b08fbdd471f8a274/cGJvdC10eHQ=/
See attacks like this logged: http://www.bizimbal.com/odb/details.html?id=1126228
polonus