I've found some bad JS that tries to open pop-unders and even deliver a likely malicious SWF file for a flash exploit.
Thing is, its stored on a google server in a directory it really shouldnt be. This allowed it to evade my block list.
Is there some way I can inform google about this? Can anybody with more experience tell me if I should do that?
It is served from storage.googleapis.com (https) in a directory for the prototype library. That, to me, seems not good. I have the JS code if anybody wants to see it, its really long so I dont want to put it here.