Re: http://urlquery.net/report.php?id=1492256394856
and https://aw-snap.info/file-viewer/?protocol=not-secure&tgt=xewoza.com%2Flink%2F10564%2F18374&ref_sel=GSP2&ua_sel=ff&fs=1
and http://www.domxssscanner.com/scan?url=http%3A%2F%2Fconcept2016.blogspot.ru%2F+
and http://retire.insecurity.today/#!/scan/ff5b23d1b0f66e1b533316cb570e47e0217acd0012f1c039dc8e1a47e2778627
Consider: http://www.domxssscanner.com/scan?url=http%3A%2F%2Fumekana.ru%2Fretarget%2FPTpxFg42GxYBAgc5DRdEUlUb
List of scripts included
-http://logsoc.ru/11eynch3yw1blegrc5580rp89kky151492x9crpt
-http://mobtop.ru/c/81717.js → http://www.domxssscanner.com/scan?url=http%3A%2F%2Fmobtop.ru%2Fc%2F81717.js
polonus (volunteer website security analyst and website error-hunter)