I didn't log the previous two IPs, but the one I just deleted was from 195.225.177.81, and it was the same username as the first. Same tactics as the first, whack a redirect in a script tag and a div over most of the page (don't think he bargained on some people being able to make their browser 1920 px wide, muwahahaha). -- Miguel.