The HookAds campaign leverages decoy adult sites to spread malware. The malicious iframe points to a fake ad server acting as a gate for RIG EK: The domain milliption.gdn resolves to 62.75.195.128.128. The campaign has been using this IP address since February: The domains being used by this campaign are registered to [email protected]: Researchers at Malwarebytes say the campaign is spreading malware.”]
Source: https://malwarebreakdown.wordpress.com/2017/03/21/hookads-campaign-leads-to-rig-ek-at-92-53-104-78/