This is more like what we are looking for, this report - a bad webrep site: See: http://app.webinspector.com/public/reports/17388672?cache=true (supporting my evaluation as innocent txt file) See: http://app.webinspector.com/public/reports/17392931 → https://www.malwarepatrol.net/cgi/search.pl?id=VHJvamFuLlZCUy5VbWJyaWVsLmE= → https://www.virustotal.com/en/file/1200c188a37466403682042fd8c768fc706601b1093897fee306ffd064239ea7/analysis/ which file avast! detects as VBS:Shutdown-R [Trj] http://wepawet.iseclab.org/domain.php?hash=a896259dbf430791d67b8e6f7f9786b9&type=js and with this scan we rounded our circle of scans: http://wepawet.iseclab.org/view.php?hash=794b97dfcb1f6512dbac8e7decf4bb62&t=1375870095&type=js Verdict: suspicious
polonus