Hi Pondus,

Quttera flags this (39 instances of this): Severity: Suspicious
Reason: Detected URL that was generated during page execution.
Details: Procedure [write] has been called with a string containing hidden URL ‘lostwebtracker.com
which IDS alerted for as “2013-10-03 10:33:05 urlQuery Client Internal IP 2 ET CURRENT_EVENTS DNS Query to a .tk domain - Likely Hostile”

polonus