This package was posted in one hacking board as http bot. After checking the file here results: Domains used : hoseen454r.com inactive onetimes27s.com active Resolved : [ onetimes27s.com ] To [ 178.250.245.186 ] Panel: hxxp://178.250.245.186/pref1/ password protected Sample here Hosting infos: http://whois.domaintools.com/178.250.245.186