Yes it does. I just checked 'History' and http://blig.ig.com/index appears there. (hadn't thought to check it before) The malware my be inherent to that site and not part of James54's hack but he brought it here so the intention is the same AFAIC.
The prefix to that URL 'cricamarvin', which is part of the URL the JPG comes from, may indicate his personal connection to that site. More internet savvy FReepers might know the significance of that.
>>The prefix to that URL 'cricamarvin', which is part of the URL the JPG comes from, may indicate his personal connection to that site. More internet savvy FReepers might know the significance of that.<<
That's the user ID of some Brazillian person who hosts his site at ig.com.br
As nearly as I can tell he only used that ID on that one page. Somebody who speaks spanish could probably tell more but this is unlikely to be your perp since that site is widely linked to it's more likely to be just be where the perp got the image from.