Seeing FakeAV infected clients calling in to update1.keepinsafety.com:
http://update1.keepinsafety.com//?tch=kdjf0tXm1J2a0Nei2Mrh24U%3D
Seen threatexpert and malwareurl reports/listings for update2.keepinsafety.com as well. www.keepinsafety.com is also known by google to be a reported attack page.