---

Looking on google along those lines it appears they are all v6 sites. Possibly they were attacked earlier when the were vulnerable and some of them even may still be vulnerable. Some sites appear to suffer either injected iframes or inserted weblink panels. These sites need to be cleaned with a full scan of the database and files on the server.