A closer look at the Curves SWF
Interesting.
"openadstream.net/ad0.php?url=http://ad.doubleclick.net/click/nxtgcbb80290000125ave/direct/wi/ai&key=V24567233828272323&c=127500043"
"iexplorer-security.org/?id=463400043"
iexplorer-security.org has hidden some information behind Privacy Protect, but we can find out some things.
First, iexplorer-security.org is hosted by Masterhost in Russia. Second, its nameservers are provided by the infamous eshosst.com (aka estdomains) - the list of malicious/fraudulent domains associated with Estdomains is staggering.
I'll need to get in touch with Doubleclick about their appearance in a variable.