SQL Injected jscript sites

[pcaccent]

<script src=hxxp://www.advertbnr.com/b.js></script>
<script src=hxxp://www.bannerupd.com/b.js></script>
<script src=hxxp://www.cookieadw.com/b.js></script>
<script src=hxxp://www.en-us18.com/b.js></script>
<script src=hxxp://www.refer68.com/b.js></script>

[JohnC]

Thanks.

[YanceySlide]

Added:

hxxp://www.bigadnet.com
hxxp://www.fengnima.cn
hxxp://www.adsitelo.com
hxxp://www.advabnr.com
hxxp://www.qiqicc.cn

As a reminder, the full list I'm maintaining is at:
http://www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20080514

[JohnC]

Thank you YanceySlide.

[pcaccent]

hxxp://www.jetadwor.com/b.js

[JohnC]

Thanks.

[sowhat-x]

Google for:

iframe src=http://www.oiok01.net/s1.htm?

[sowhat-x]

src=http://www.clsiduser.com/b.js
src=http://www.domaincld.com/b.js
src=http://www.updatead.com/b.js

And the following ones...which in contrast with the above,
either they've just started injecting around,or they're older failed attempts...

src=http://www.app52.com/b.js
src=http://www.asp707.com/b.js
src=http://www.aspx49.com/b.js
src=http://www.aspssl63.com/b.js

Have a nice day... 

[YanceySlide]

Sorry, I haven't been updating this thread like I meant to.

The following are new as of today:
hxxp://www.adwste.mobi
hxxp://www.bnrupdate.mobi
hxxp://www.adupd.mobi

They're not yet being injected, but they are Danmec/Asprox domains.

[YanceySlide]

Four more:
hxxp://www.adwsupp.com
hxxp://www.hdadwcd.com
hxxp://www.kadport.com
hxxp://www.suppadw.com

[JohnC]

Thank you

[YanceySlide]

New:
hxxp://www.web923.com

[YanceySlide]

Four more:
hxxp://www.csl24.com
hxxp://www.get49.net
hxxp://www.pid72.com
hxxp://www.pid76.net

[sowhat-x]

src=http://www.j8j8hei.cn/k.js -> 235000 sites injected...

The following ones haven't been injected that much yet...

src=http://www.qq117cc.cn/k.js
src=http://www.qq117cc.cn/ri.js
src=http://www.batch29.com/b.js
src=http://www.dl251.com/b.js
src=http://www.supbnr.com/b.js
src=http://www.hlpgetw.com/b.js
src=http://www.rid34.com/b.js

And the following to be blocked as well...

hxxp://www.bdsae.org.cn/bdsae/aa.htm?11
hxxp://www.qq117cc.cn/456.htm
hxxp://www.qq117cc.cn/dj.htm
hxxp://bnrupdate.mobi/cgi-bin/index.cgi?ad
hxxp://pid76.net/cgi-bin/index.cgi?ad
hxxp://hdadwcd.com/cgi-bin/index.cgi?ad
hxxp://adupd.mobi/cgi-bin/index.cgi?ad

[MysteryFCM]

The following aren't resolving for me atm?

Code: [Select]

Error 9001 - Can't resolve host j8j8hei.cn
Error 9001 - Can't resolve host www.j8j8hei.cn
Error 9001 - Can't resolve host qq117cc.cn
Error 9001 - Can't resolve host www.qq117cc.cn
Error 9001 - Can't resolve host qq117cc.cn
Error 9001 - Can't resolve host www.qq117cc.cn
Error 9001 - Can't resolve host bdsae.org.cn
Error 9001 - Can't resolve host www.bdsae.org.cn
Error 9001 - Can't resolve host qq117cc.cn
Error 9001 - Can't resolve host www.qq117cc.cn
Error 9001 - Can't resolve host qq117cc.cn
Error 9001 - Can't resolve host www.qq117cc.cn