See: https://www.virustotal.com/nl/url/86084b7c80f947e027366fd1fa485321c666bb4805e20cb04cbf61c7ec77cea5/analysis/1449334262/
See: http://urlquery.net/report.php?id=1449334388710
Scanning -http://zdnzz.super-promo.hoxo.info …
Script loaded: -http://www.google.com/adsense/domains/caf.js
Script loaded: -http://zdnzz.super-promo.hoxo.info/glp?r=&u=http%3A%2F%2Fzdnzz.super-promo.hoxo.info%2F
And in this code: http://www.domxssscanner.com/scan?url=http%3A%2F%2Fzdnzz.super-promo.hoxo.info%2Fglp%3Fr%3D%26u%3Dhttp%253A%252F%252Fzdnzz.super-promo.hoxo.info%252F
we find a link to here: -tracking.bodis.com → https://adguard.com/en/adguard-report/tracking.bodis.com/report.html
& http://scamanalyze.com/check/tracking.bodis.com.html a verified scam…
→ https://otx.alienvault.com/indicator/domain/tracking.bodis.com/ & http://www.cyphort.com/affyield-com-serving-zero-day-flash/
polonus