Domains used in this attack:
(and many others)
Any web site (no specific target).
This malware is generally hidden at the bottom of the .html or PHP files. Sign up here to get it clean up: Signup
Malware dump (sample of malware):