Resolved painadiction.biz to 91.231.85.228
I found this bot running as an update on a few of the barracuda http nets that I had already posted. I would imagine someone has found a vulnerability in the panel.
Server: painadiction.biz
Gate file: /moneymaker/image.php
There are a few other domains with the same registration email (soyperlman@live.com) on the ip
dreadmar.pro
dreadmari.biz
dreadmarall.biz
painadiction.com
painadiction.net
Hosting infos: http://whois.domaintools.com/91.231.85.228
Edit: Discovered a POE stealer panel on the same ip.
Server: 91.231.85.228
Gate file: /poe/index.php