Interesting. It'd be great if you could write this up as a blog post, explaining your motivation and methodology while giving examples of what's happening.

Good find.

If you want to expand the search, NCES might be a good way to collect additional sites to try: http://nces.ed.gov/collegenavigator/

Do you have any hypotheses about a common vector for the hack? In addition to run-of-the-mill vectors, there's also the possibility that educational middleware (online class management a la Sungard, Blackboard, PeopleSoft) is vulnerable -- this is pure speculation, of course, but as someone who worked with dozens of those portals it piques my curiosity.

let's share those urls you're talking about.

In that case, the headline and summary are very misleading. The summary says "edu, .gov, websites from US" but you say the sampling includes Turkish/Azerbaijani academic websites. I don't think I'm the only person who would read ".edu" and assumes that it _unambiguously_ means US academic sites. If you can provide a full list of your sample, that would be useful to put some detail into this statistic.

It would be fascinating to see results from a selection of big well known universities in US, EU, etc.