from an affiliated site (?): http://cerabos.co.be/index.php?tp=0c9b13a3940500bc -- looks to be located in Belgium? Malware: JSownloader-AQW. You guys may have one or more advertisers proliferating malware on your site; please check them out. Thanks. :smile: Edit: Just did a nslookup, and it reported ip addresses 188.8.131.52, and 184.108.40.206. Hope this helps.