Exploit Toolkit Website 33 Attack

For the second time in a week, I've gotten a popup from my Norton Internet Security when I've accessed the site. The details are in the attachments.

It doesn't happen every time I access it, but this specific threat has only happened when I accessed it. One possibility I was thinking about, perhaps the redirect is coded in one of the banner ads that rotate on the main page? Since the redirect occurs as soon as I had accessed the page, I didn't have the chance to even see what banner ads(s) were up at the time.

I'll post if/when it happens again.

Anyways, if anyone else has had this happen, chime in.

The destination IP address shows up in Latvia.

Nothing here. But looking at that error screen of yours, it appears to be saying that the attack is coming from your own PC. Or am I just reading that wrong?

I believe it's saying that because that's where the Internet Explorer resides.

I know this might sound dumb, but did you scan your own computer using another virus checking program?

Doesn't sound dumb at all. The only anti-virus software I use is NIS, but I also use Spybot S&D as well, neither have come up with anything.

Rich I've gotten 3 attacks in 2 days. My Norton says it's Blackhole Toolkit Website 36, Blackhole Toolkit Website 31 and Exploit Toolkit Website 33. What I've read via google my Norton IS 2013 is saying that there is malware loaded in an add somehere on Fauna and every time I visit Fauna's website Norton is blocking an attack from this malware which is trying to expolit vulnerabilities on my pc.

Google is saying the malware has to be wiped at the website hosting servers end. According to Norton this malware is very high risk. The malware tries to load a trojan which steals login password info. So if you pay your bills online BEWARE! I've done scans on my pc and Norton says it's not infected. Since yesterday Norton has blocked 3 high risk attacks and I only get them when I go to Fauna.

For the 3rd time today, my AVG blocked a threat. Not 4 minutes ago, I clicked on an ad for Bufo alvarius adults posted by a "Bruce Banner" and got the latest threat blocked. I, too, only got the threats here.

Unfortunately, I didn't look closely at the threat, so can't ID ... but I use AVG, Spybot S&D, Malwarebytes and CCleaner, and use all regularly. (Can you call me paranoid? lol)

Beats me. I haven't seen anything of that nature myself. I took a look around on the server for both the FaunaClassifieds.com and FaunaAds.com files, and nothing looks out of place there. If it is a particular Google ad that is causing the problem, I can block it if I know the source URL for it, and alert Google about that problem.

But Google ads aren't really as content focused as they used to be, and are more weighted towards YOU and other places you have visited and what keyword searches you might have used in their search engine. So it's quite possible that I will NEVER see the same Google ads that someone else is seeing here.

So if it happens again, all I can ask is that you try to determine the actual source of the problem and I'll do what I can about it. Not much else I can do at this point with the information provided.

I just went back to see if I could ID the blocked threats on my AVG program ... naturally, the info was not archived. I will pay much better attention if it should happen again.

The scan I ran was clean.