(and many other domains).
Any web site
This malware is generally hidden on .js or .php files without heavy encoding. Sign up here to get it cleaned: http://sucuri.net/signup
Malware dump (sample of malware):