Domains and IPs to Block ASAP
Two posts from the Internet Storm Center:
SQL Injection Lilupophilupop style –Lists about a dozen domains you should immediately add to your blocklists plus more in Dynamoos blog.
Zeus/Citadel variant causing issues in the Netherlands – Follow the links and block those IP addresses