ronpaulweb.com

[boston]

xttp://ronpaulweb.com/ leads to exploits:
http://wepawet.cs.ucsb.edu/view.php?hash=fc4bef4474d975ca7c99783d1c2144ba&t=1342809211&type=js
http://wepawet.cs.ucsb.edu/view.php?hash=43a89dabbb0cac1c2451f15434a1e011&t=1342809300&type=js
final payload:
https://www.virustotal.com/file/7f1908cc286fdad142bac640609ab97df879fda610a7ec0d94a4d2587ffe5d0b/analysis/

[MysteryFCM]

The site the iFrames lead to, already appear to have been killed. I'll get in touch with the host and registrar for ronpaulweb.com, and get it cleaned and secured.

[boston]

they did not clean the site, but xttp://scommetticonme.it/viaggiare.htm is now 404.
xttp://figuurverhuur.nl/main.php is still online.

[MysteryFCM]

I'll get on the phone and shout at them again, cheers for letting me know.