Hi Steven Winderlich,

Those are noth PHISHING attacks. See:
http://jsunpack.jeek.org/?report=0fc4a2ba63f3ce1ba930dac8df4c7ea5952435bd
and
http://jsunpack.jeek.org/?report=762d03bb5f616cea9dec490895f5055afacec8d8
Website has suspended status…see: https://www.virustotal.com/en/ip-address/200.63.97.55/information/
seems to be dead according to here: http://support.clean-mx.de/clean-mx/phishing.php?id=3471867
not being blacklisted now: http://www.ipvoid.com/scan/200.63.97.55/

Damian