See: http://toolbar.netcraft.com/site_report?url=http://5.135.28.110
5.135.28.110:8080,5.135.28.110:80 → 5.135.28.110:8080/warez/adm.php
Andromeda criminal bot - detection missed? Only DrWeb has it: https://www.virustotal.com/nl/url/f0ecc99f0d23553f4b9c6dc1c2da38d786e74e9c79c291711689f457b47202e5/analysis/
http://urlquery.net/report.php?id=1408051236156
Read from Adam Greenberg on Andromeda bot: http://www.scmagazine.com/andromeda-bot-spreads-tor-using-ctb-locker-ransomware/article/362830/
Upload Vulnerability: http://pastebin.com/4Hr5ZJfB PHP/5.4.4-14+deb7u11
polonus