One external link to watch: js dot users dot 51 dot la

Re: http://urlquery.net/report.php?id=1417297049909 (link yellowed out) - see blacklist alerts
Badness history: https://www.virustotal.com/en/domain/js.users.51.la/information/
The link as such: http://urlquery.net/report.php?id=1415486052898
With us for a long, long time: http://blog.dynamoo.com/2008/06/one-to-watch-jsusers51la.html
See: http://www.threatexpert.com/report.aspx?md5=0723853d940e027cb268f580b4d6f453
Where we discussed it earlier: https://forum.avast.com/?topic=59520.5

polonus

Update - detected here: htxp://most.ipkam.pl/ → https://urlquery.net/report/be39cd04-6c6c-43ac-aae1-15ce8989a285
Re: https://urlscan.io/result/9a37d08a-c727-4c61-b3a1-e1dec3646fd9#summary
& https://aw-snap.info/file-viewer/?protocol=not-secure&tgt=most.ipkam.pl%2F&ref_sel=GSP2&ua_sel=ff&fs=1
error in code

-most.ipkam.pl/js/6.js
info: [script] -most.ipkam.pl/js/function.js
info: [script] -most.ipkam.pl/js/ocx.js
info: [frame] -most.ipkam.pl/asp/view.asp
info: [decodingLevel=0] found JavaScript
error: line:114: SyntaxError: missing ) after argument list:
error: line:114: document.write(“”);
error: line:114: …^
ocx.js suspicious: maxruntime exceeded 10 seconds
script
149: doc​ument.write ("< FRAMESET id=‘Frameset’ rows=100% framespacing=0 border=0 frameborder=0> “);
150: doc​ument.write (”< FRAME SRC=‘asp/view.asp’ NAME=‘main’> “);
151: doc​ument.write (”< /FRAMESET> ");

polonus (volunteer website security analyst)