Resolved qwer.be to 119.59.99.200
This domain was previously feature hosting YZF.
Server: qwer.be
Gate file: /lock/lending/tds.php
Admin page is as /lock/index.php with credentials admin:admin
Hosting infos: http://whois.domaintools.com/119.59.99.200
Anonymous - January 6, 2013 at 2:15 pm
http://myinstalls.info/neuro/
andromeda
I_Post_Ur_Info - January 6, 2013 at 4:18 pm
http://www.exposedbotnets.com/2012/11/myinstallsinfo-andromeda-and-kbot-http.html
Anonymous - January 7, 2013 at 8:15 pm
http://dreadmari.biz/moneymaker/
legit andromeda, do work. from /b/
Pig - January 7, 2013 at 9:14 pm
nice work and thnx for the contribution
I_Post_Ur_Info - January 8, 2013 at 1:57 am
Hmm, I think it might be an alternate domain of this one: http://www.exposedbotnets.com/2012/12/painadictionbiz-andromeda-http-botnet.html
Same ip, same panel location. I just noticed a stealer on the server that I added to the blogpost.