amazinghost.lt, yahgodz.com (Smoke and Andromeda loaders hosted by Netherlands Maasdijk Worldstream)

I happened to notice some people taking about one of mysticals old domains, indicating that it had been sold. I decided to check out the domains I had listed in the blog post to see what was on them.

I found something new on 307dice.com
Smoke loader
Server: 307dice.com
Gate file: /cp/index.php
Check out 307dice.com/cp/guest.php with guest:guest to confirm.

Andromeda loader is still up on img196-imageshack.us
Andromeda
Server: img196-imageshack.us
Gate file: /pannel/image.php

I also found something else interesting. Hosted on the same server as img196-imageshack.us was amazinghost.lt. I decided to check that out.
Smoke loader
Server: amazinghost.lt
Gate file: /admin/index.php
Check out amazinghost.lt/admin/guest.php with guest:guest to confirm.

After that I decided to see what was on the same server as 307dice.com. yahgodz.com. Hmm lets check that out. Authentication request on the index page?
Andromeda
Server: yahgodz.com
Gate file: /image.php

Just checked back again and now 307dice.com is on the same server as bighecks.net and ddosonline.com. Open directory shows /cp/ and /m/ as folders.We know what /cp/ is, so lets check out /m/.

Pandora
Server: 307dice.com/bighecks.net/ddosonline.com
Gate file: /m/index.php
Check out 307dice.com/m/config.php to see some settings.

The whois for ddosonline.com has Gwapo Logist as the owner. 

Hosting infos: http://whois.domaintools.com/217.23.4.70
http://whois.domaintools.com/109.236.83.10