from an affiliated site (?): http://cerabos.co.be/index.php?tp=0c9b13a3940500bc -- looks to be located in Belgium? Malware: JSownloader-AQW. You guys may have one or more advertisers proliferating malware on your site; please check them out. Thanks. :smile: Edit: Just did a nslookup, and it reported ip addresses 18.104.22.168, and 22.214.171.124. Hope this helps.