Resolved mirror.servehalflife.com to 220.127.116.11
Gate file: /barra/bot.php
You may remember this no-ip from a previous post
Same shit is still in /files/ the only changes being that blackshades now connects on own3d-private.no-ip.org on port 55050, and it uses the no-ip files.serveblog.net to download the other files.
More links found by Xylitol:
Hosting infos: http://whois.domaintools.com/18.104.22.168