http://qqq-111.zapto.org/show.php http://fwjiwjieje.mooo.com http://update-java.kit.net/java.js (and many other domains).
Any web site
This malware is generally hidden on .js or .php files without heavy encoding. Sign up here to get it cleaned: http://sucuri.net/signup
Malware dump (sample of malware):