The Iframe in Iframe false positive

Hello,

We discovered another possibly suspicious URL: sys.refocus.ru/f1.tyx, which we also
consider to be a false positive.
sys.refocus.ru/f1.tyx is generated as iframe and dynamically inserted
on a webpage by sys.refocus.ru/ra.js script, which we already sent to
you for analysis.

Within this iframe we have another iframe
http://sys.refocus.ru:7070/f2.tyx, [^] and our partner resource is
loaded inside the second iframe ‘f2.tyx’. In this moment you can find
such behavior only on http://anas.kg[^] website (hardcoded only for
this website)

<iframe>
<iframe>
Here goes partner resources
</iframe>
</iframe>

Currently we cooperate only with aidata.me, but we are also going to
cooperate with others like bluekai, visualdna, etc. Partners just
collect audience statistics in order to conduct more precise
advertisement campaigns.

Here is code provided by aidata that is inserted inside the second
iframe.
<img height="1px" width="1px" alt=""
src="http://advombat.ru/0.gif?pid=&id="[^] style="display: none
!important;">


Feel free to contact me, if you require any further information

Best Regards,
Alekander,
Solid Media LLC