I happened to notice some people taking about one of mysticals old domains, indicating that it had been sold. I decided to check out the domains I had listed in the blog post to see what was on them.
I found something new on 307dice.com
Gate file: /cp/index.php
Check out 307dice.com/cp/guest.php with guest:guest to confirm.
Andromeda loader is still up on img196-imageshack.us
Gate file: /pannel/image.php
I also found something else interesting. Hosted on the same server as img196-imageshack.us was amazinghost.lt. I decided to check that out.
Gate file: /admin/index.php
Check out amazinghost.lt/admin/guest.php with guest:guest to confirm.
After that I decided to see what was on the same server as 307dice.com. yahgodz.com. Hmm lets check that out. Authentication request on the index page?
Gate file: /image.php
Just checked back again and now 307dice.com is on the same server as bighecks.net and ddosonline.com. Open directory shows /cp/ and /m/ as folders.We know what /cp/ is, so lets check out /m/.
Gate file: /m/index.php
Check out 307dice.com/m/config.php to see some settings.
The whois for ddosonline.com has Gwapo Logist as the owner.
Hosting infos: http://whois.domaintools.com/18.104.22.168