SQL Injected jscript sites

[sowhat-x]

Heh,they have been rebooted for maintenance or something:
i tried 5 minutes ago and they were down,i tried 2 minutes ago,and they were up...

[MysteryFCM]

hehe ya gotta love 'em

[YanceySlide]

Thanks, added the missing ones to my list.

I had been remiss in adding new entries here when I updated http://www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20080514 so several got added there that didn't show up here.  Sorry about that.

[sowhat-x]

Lol no problem,here's another one for you 

hxxp://www.maigol.cn/ri.js

Very fresh...google returns nada for the time being,he-he...

[YanceySlide]

Lol no problem,here's another one for you 

hxxp://www.maigol.cn/ri.js

Very fresh...google returns nada for the time being,he-he...

Added, thanks!

[sowhat-x]

...is it my impression,or it seems like Google got fed up with the Asprox guys,
and decided to go...the "hard" way against them,he-he...

src=http://www.j8j8hei.cn/k.js

-> Now it returns only 14300 results instead of 235000...

[JohnC]

Thank you.

[YanceySlide]

...is it my impression,or it seems like Google got fed up with the Asprox guys,
and decided to go...the "hard" way against them,he-he...

src=http://www.j8j8hei.cn/k.js

-> Now it returns only 14300 results instead of 235000...

Try querying some of the other "googles".  Like, google.co.uk or google.com.au or google.de.  I find I get different counts.  google.com has a more aggressive expiry.

Also, new domains this morning:
www.cntrl62.com
www.config73.com
www.default37.com

[YanceySlide]

www.debug73.com

[JohnC]

Thank you.

[YanceySlide]

Today's list:
www.canclvr.com
www.ktrcom.com
www.lokriet.com
www.mainbvd.com
www.portwbr.com
www.stiwdd.com
www.testwvr.com
www.ucomddv.com
www.upcomd.com

[JohnC]

Thank you

[YanceySlide]

New:
www.adwadb.mobi
www.allocbn.mobi
www.catdbw.mobi

[JohnC]

Thanks.

[sowhat-x]

Quick'n'dirty list of sites and blogs that have recently posted lists of sql injection sites,
in case we've missed any of them...some of them are frequently updated as well:
http://www.bloombit.com/Articles/2008/05/ASCII-Encoded-Binary-String-Automated-SQL-Injection.aspx
http://infosec20.blogspot.com/2008/06/asprox-sql-injection-botnet-and-iframe.html
http://s3cwatch.wordpress.com/

Ilion's blog is mentioned earlier in the thread...and ShadowServer's wiki obviously