Originally Posted by ladida

That domain it's referencing is stealing your traffic. You won't find it in cleartext like you think because that would be too easy. It's most likely obfuscated in javascript or hex or some other crap like that they like to use. Get someone to clean it for you if host can't.