e.nuclear3.com/bbs/ad/

another injected domain that resolves to the same IP address as c.8e9.net

c.8e9.net/bbs/ad/

another sql-injected domain. So what’s new? The name of the JS file seems to be tied to the site language.

61.31 235.114

foolishness or desperate? Sql-injection attack which links to an ip address instead of domain.

The injected script link is 61.31.235.114/i.swf

However i.swf currently does not exist on the machine. What exists is 1.swf.

more domains sql-injected

This is a list of more sql-injected domains:

• sion.or.kr/iis.swf
• www.81dns.ru/script.js  -> http://berjke.ru/cgi-bin/index.cgi?script
• il3er.cn
• www.ko118cn/a.js