iFrame malware not blocked?

Viruses and worms
1

See: http://killmalware.com/p90xtrade.com/
and http://sitecheck.sucuri.net/results/p90x-p90xsales.com
see: https://www.virustotal.com/nl/url/8445c76c7c0f41f21a8bd6cf8d6296b36dfcb5f24266baa077454c03e2fe04f9/analysis/
Site address is landing here: htxp://www.beachbody.com/product/fitness_programs/insanity-next-level-asylum-workout.do?code=FLX_147_ASY
See: http://quttera.com/detailed_report/p90x-p90xsales.com see attached for 1 example
confirmed by http://w3techs.com/sites/info/p90xvideosdvd.com
also see: http://sitecheck.sucuri.net/results/workoutp90xvideo.com

polonus

2

undetected…or not malicious?
https://www.virustotal.com/nb/file/7cc11097a1318218f62ae4fadd0b2f39e6ba00b6d58ce086a1015d5209c51f07/analysis/1398556817/
https://www.virustotal.com/nb/file/b328e34154611c9fdf1f7a1c63897a3746b7224fa1d8de37d684df94b4171aea/analysis/1398557142/

3

Pondus, there is a server redirect: Code: 302, htxp://affiliate.tpptracker.com/rd/r.php?sid=360&pub=200057&c1=p90xtradecom&c2=&c3=
Redirect to external server!
And that should not be there: https://www.mywot.com/en/scorecard/tpptracker.com?utm_source=addon&utm_content=popup

Spamming is the name of the g(fr)ame here :smiley: (Phantom ad program to ad-x.co.uk → http://forums.androidcentral.com/general-help-how/215698-phantom-program.html (info credits go to still1 there)

Web Security Test flags, but Zulu Zscaler sees the redirects as intended: http://zulu.zscaler.com/submission/show/cd58f23124a5c59753c2a6304b23d204-1398557926 benign 21/100%

And SOA dbs issues found up: http://dnscheck.pingdom.com/?domain=p90xtrade.com&timestamp=1398558162&view=1
The host name is an alias (CNAME), which is not allowed. Host names must be published with an A or AAAA record.

pol