Today, I received a communique from a very nice anonymous supporter of ours.
He has informed me of greenbooter's URL. Not very hidden. It's as if they WANT to be found, so someone can shut them down and the owner can blame booter down and just run off with his customer's money.
Anyway, here's their list of shells. Do enjoy.
*Link Removed*
If your server(s) is/are on this list, you may want to look into finding out how he got in and patch up that hole.
Most likely it will be from a WebDAV exploit where you haven't changed the default user/pass.
Just skimming through his list, I see he adds multiple shells from the same server to make it seem like he has more shells.
http://63.229.71.9/webdav/clay94.php
http://63.229.71.9/webdav/clay83.php
http://63.229.71.9/webdav/clay84.php
http://63.229.71.9/webdav/clay85.php
http://63.229.71.9/webdav/clay86.php
http://63.229.71.9/webdav/clay87.php
http://63.229.71.9/webdav/clay88.php
http://63.229.71.9/webdav/clay89.php
http://63.229.71.9/webdav/clay90.php
http://63.229.71.9/webdav/clay91.php
http://63.229.71.9/webdav/clay92.php
Ripping off his customers
Here is his database: *Link Removed*
Do enjoy.