Hi Pondus,

You are right. I just had a look at the source via a security proxy. See malscript below that is being flagged,

polonus