Update/Errata: I got all excited when I saw "information_schema", hoping that this is finally something new. Turns out in my ignorance of SQL Server, I didn't realize that Microsoft SQL Server uses information_Schema as well. So this is just "yet another" SQL Injection like we have seen so many over the last few year. (and prior attacks used "information_Schema" already)

I removed the paragraph about MySQL below.

 Sorry. Johannes.

 (can someone please come up wiht something new and different? ;-) )

It's been a while since we published the diary about the lilupophilupop SQL injection (https://isc.sans.edu/diary.html?storyid=12127) that back in January had infected LOTS of web sites. But guess what, they are b-aaa-ck, and are trying pretty much the same thing.

which decoded looks as usual:

Searching for the injected "lasimp04risoned" URL via Google shows that bad guys don't seem to be as 'successful' with this attack as last time, but this can change. If you have additional information from your web server logs, especially also information on which server or content management system is being targeted this time, please let us know.

Thanks to ISC reader Mike for sharing the excerpt from his web logs!