What unknown html malware is on this site?

Viruses and worms
1

See: http://zulu.zscaler.com/submission/show/9acdb19ad1f7a34c57db22ca10cb6758-1362923539 Flagged as PHISH
The location line in the header above has redirected the request to: htxp://prorse.cl/pp/home/websc/
But other domain on that IP is spreading EXPLOIT-KIT Blackhole landing page with specific structure - prototype catch

polonus

2

This website is in the DrWeb’s malware list. Why? See: http://www.urlvoid.com/scan/usuarios.multimania.es/
htxp://usuarios.multimania.es/raspbesx/chocr/ki2d.html is in Dr.Web malicious sites list!
URL Blacklist com reports: Results
Domain(s) Found in Category Matching Line Mark
malware usuarios.multimania dot es

Checking:htxp://ads.mmania.com/displaycf2.js.php?r=69940bb9&cc=es
File size:2747 bytes
File MD5:a4421aeac07a2e12102f4bfd732bf081

htxp://ads.mmania.com/displaycf2.js.php?r=69940bb9&cc=es - archive JS-HTML

htxp://ads.mmania.com/displaycf2.js.php?r=69940bb9&cc=es/JSFile_1[0][abb] - Ok
htxp://ads.mmania.com/displaycf2.js.php?r=69940bb9&cc=es - Ok

Checking:htxp://usuarios.multimania.es/raspbesx/chocr/ki2d.html
Engine version:7.0.4.9250
Total virus-finding records:3719317
File size:13.14 KB
File MD5:52ebef6ba764a6faaaa5cf32c74e2a7d

htxp://usuarios.multimania.es/raspbesx/chocr/ki2d.html - archive JS-HTML

htxp://usuarios.multimania.es/raspbesx/chocr/ki2d.html/JSTAG_1[20][1a8] - Ok
htxp://usuarios.multimania.es/raspbesx/chocr/ki2d.html/JSTAG_2[99d][13c9] - Ok
htxp://usuarios.multimania.es/raspbesx/chocr/ki2d.html/JSTAG_3[32ac][de] - Ok
htxp://usuarios.multimania.es/raspbesx/chocr/ki2d.html/JSTAG_4[33b7][ca] - Ok
htxp://usuarios.multimania.es/raspbesx/chocr/ki2d.html - Ok

If we really want to know, we try to go to htxp://usuarios.multimania.es/raspbesx/chocr/ki2d.html | {gzip} and the avast! Web Shield blocks this trojan horse as JS:Redirector-ZH[Trj] We are being protected!

Check for all partial results found at STOPBADWARE dot ORG: http://www.stopbadware.org/clearinghouse/search#search/?url=usuarios.multimania.es/&_suid=1362927001114024155784697987615
and one of the exacts: http://www.stopbadware.org/clearinghouse/search#?exactonly=true&url=http%3A//usuarios.multimania.es/aafloip/&_suid=136292713362505647584537602496

polonus