Can we see the list so I can know if my site is vulnerable and fix it?

Why hasn’t the list of sites been published? There are a few reasons:

• I didn’t want this to be a ‘name and shame’ as the sites on that list are, after all, victims of attacks. Someone broke into their site, and the owners probably have no idea.
• If the list is widely disseminated and absorbed into blocklists, trying to get your domain of those lists afterwards is close to impossible. For a small business, that could be devastating.
• Many of these websites were likely infected because of an existing vulnerability that was exploited in something like WordPress, Magento or similar. Handing out a list of viable targets does not seem like a good idea.

Cynically speaking, their story disappears if too many people fix their websites.