It is a technique somewhat similar to SQL Injection payloads utilizing comment specifiers (– or ;– or #) at the end of their payloads. The RFI attackers do not know what the remainder of the PHP code that they are going to be included into is supposed to do. So, by adding the “?” character, the remainder of the local server PHP code is actually treated as a parameter to the RFI included code. The injected RFI PHP code simply ignores the parameter data so it will only execute its own code.

You can report the sites to Google: http://www.google.com/safebrowsing/report_badware/

OpenDNS has domain tagging, but it does not appear to include malicious sites. The closest thing I see is an ‘adware’ tag: http://www.opendns.com/community/domaintagging/about/