198.8.81.127 (Pony http loader hosted by coloat.com)

Server:  198.8.81.127
Gate file:  /Panel/gate.php

Starting to see some pony bots now that it’s been leaked.
FYI, pony just grabs passwords and uploads them, then downloads any files that are hard coded into it. If you set it to run at startup you’ll just get the same shit every time.

Hosting infos: http://whois.domaintools.com/198.8.81.127