SophosLabs scan parts of the internet looking for potentially malicious iframes. Each day an automated script analyses them and sends an email to Sophos Labs with details of the iframs. Many legitimate sites have similar characteristics to malicious ones making detection problematic. For the bulk of domains referenced in malicious iframs, the domain is recently registered. The site has been associated with other malicious scripts. The domain in question here however, was old and the registration details were valid (registered to a major Asian Government).”]
Source: https://nakedsecurity.sophos.com/2007/08/06/winds-of-change/