On July 14, I'm pretty sure that this page would have been Porntube III - by August 5, when I started logging page changes, it was displaying what appears to have been a Joomla page.
This particular page represents the last 200 return I had from the server, yesterday; it is now 404'd. I believe that this server was re-hijacked using a Joomla exploit. The Javascript is gone, so we don't know a lot about what this page is trying to do -- but we could search on this, and I'd bet we'd find a lot.
Interestingly, this is not the only re-hijack. I scan these servers every 4 hours, and every 4 hours I see a different page. During the time it was Joomla, this is due to Joomla changing the session ID every time. But on August 15, it was replaced by this page, which appears to be identical to BN3's "BBC NEWS" landing pages. I haven't started analyzing those yet.
(No further analysis right now.)
