Figure 1. Exploit loading sequence in ria[.]ru (February 2012) Figure 2. [bg].ru (February 2012) found redirecting victims to Lurk’s exploit kit Figure 3. Redirects to the Lurk landing page from adfox[.]ru banner network Figure 4. Malicious iframe content served by tks[.]ru (August 2013)