More information about the malvertizements that appeared on guardian.co.uk and electronicsnews.com.au
There are two malvertizements that I highlighted, being:
The 300x250 malvert touches hit-detect.com and measurehits.com.
The 728x90 malvert touches ydmstats.com and measurehits.com.
We go from measurehits.com to crustat.com.
From there we go to one of several different domains:
free-webscaners.com/<<redacted>> <--- fraudware domain
If a victim is redirected to olinredr2.com then they end up at pyani.com,then offer-provider.com. offer-provider.com is a fraudware domain touting fake security software under various names such as "SpywareRemover" and "VirusRemover2009" and "AntiSpywareSolution 2009".
If a victim is redirected to truconv.com then they end up at total-virusprotection.com, another fraudware domain.