Actively being exploited as reported by Kaspersky i saw this recently against one of my honeypots which is CVE-2015-1427

The highlighted area loads this shell script

I wonder who, 'mgrey1110@gmail.com' is?