The alert is coming from the following URL;

CODE
http://www.hitsformoney.net/banniere.php?ref=lena31&fond=xx


Found so far on Fairytale-PTC, report sent via contact