Citadel and Zeus control panels were posted on Cybercrime-Tracker.
I'm on holiday today (thanks troops), and this server is hosted in America (not on my watch), so I'll take a look at it.
I observed this C&C on May 26th. According to log files, it had been operating since at least March 30th 2014
hsbconlineuk.com. 14400 IN A 220.127.116.11
NetRange: 18.104.22.168 - 22.214.171.124
NetType: Direct Allocation
The panels were mixed variety of Citadel and ZeuS, in the 'images' directory:
Seemed like a pretty boring setup, but it started acting odd.
Then I got a funny message:
inetnum: 126.96.36.199 - 188.8.131.52
descr: Tor Exit Node Hosting
That contact email is a known 419 scammer.
Zenith Bank (fake bank)