Cleartrip.com Infected with Blackhole Exploit Kit

A Cleartrip.com page contained obfuscated JavaScript that injected a hidden iframe pointing to trafficgoodster.info, which served the Blackhole Exploit Kit; the analyst de-obfuscated the code, captured the malicious iframe URL and WHOIS details for the newly registered .info domain, and noted that Zscaler notified Cleartrip and that Google has blocked the malicious URL.