Resolved betabros.in to 146.0.78.4
Server: betabros.in
Gate file: /beta/order.php
The owner should keep a closer eye on the fake forum he setup for cover. 1071 pages of pharmacy spam and counting.
Hosting infos: http://whois.domaintools.com/146.0.78.4
EDIT: Bitcoin and litecoin mining.
macromedia.exe -a scrypt -o http://us.litecoinpool.org:9332 -u marvid.disfig -p x
shell.exe -o stratum+tcp://stratum.btcguild.com:3333 -u vapor_3 -p x
Additional http botnet panels on the server:
Athena http
Server: betabros.in
Gate file: /a/gate.php
Andromeda
Server: betabros.in
Gate file: /andro/image.php
Citadel
Server: betabros.in
Gate file: /c/gate.php
Another betabot panel
Server: betabros.in
Gate file: /b/order.php