See: htxp://zulu.zscaler.com/submission/show/ed2219ddf9c1910fd885b0ebced1e09f-1336923170 100/100% malicious
goes to: htxp://zulu.zscaler.com/submission/show/d69cb935903c1f7e7c85fd1c4aa3b1d3-1336923252
see: htxp://www.mywot.com/en/scorecard/addonrock.ru
Trying to check with webbug I get: 500 Private/Reserved IP and 11004 [11004] Valid name, no data record (check DNS setup)
this is a reported attack page. Site has been infecting 2113 domains, a.o. ilahiask dot org/, c2ctaxsettlement dot com/, herox.comdot cn.
Attack detected Sun, 13 May 2012 11:24:37 +0200
Offensive html code:
Offensive url: htXp://addonrock.ru/SATA.js
Sucuri description: htxp://sucuri.net/malware/malware-entry-mwjs152 and
Dasient description: hxtp://wam.dasient.com/wam/infection_library/a48528019c740aef64820d66f3a090e3/addonrock
addon dot rock is now spreading malware like Screenshot.js, IO.js, ActiveX.js and many other malicious js files.
The initial IP 85.90.233.171 is now not longer given.
This domain should be in the imortal DNS sinkhole (has been spreading malcode since 2010 or earlier),
polonus