ABUSE! from 37.59.53.162
loadx187 <********@gmail.com>

3:22 AM (5 hours ago)

to abuse
hello i have recently been attacked with a DDoS attack controlled from the above ip. the server has a modded ircd on it..has aprox 12,000 remote control machines used to preform ddos attacks.i have done a bit of looking into this here is some of the results.

inetnum:        37.59.0.0 - 37.59.63.255
netname:        OVH
descr:          OVH SAS
descr:          Dedicated servers
descr:          http://www.ovh.com

Resolved [fuck.jorgee.nu] to [37.59.53.162] Resolved [37.59.53.162] to [loldump.org]
Scanning loldump.org (37.59.53.162) [1000 ports]
Discovered open port 8080/tcp on 37.59.53.162 <---ircd
Discovered open port 443/tcp on 37.59.53.162
Discovered open port 80/tcp on 37.59.53.162
Discovered open port 22/tcp on 37.59.53.162
Discovered open port 6667/tcp on 37.59.53.162 <---ircd
Discovered open port 3333/tcp on 37.59.53.162
Discovered open port 990/tcp on 37.59.53.162
445/tcp  filtered microsoft-ds
990/tcp  open     ftp          vsftpd 2.3.5
1010/tcp open     http         Apache httpd 2.2.22 ((Debian))
|_http-methods: No Allow or Public header in OPTIONS response (status code 200)
|_http-title: Directory listing for loldump.org/
3333/tcp open     dec-notes?
6667/tcp open     irc          Unreal ircd (Admin email you.are@a.stupid.mf)
7070/tcp open     irc          Unreal ircd (Admin email you.are@a.stupid.mf)
8080/tcp open     irc          Unreal ircd (Admin email you.are@a.stupid.mf)

Botnet channels (drones remotely controled)

#exploit# ?@#sshow ?#x00 ?##ssh ?@#l ?@#f ?#main ?#eshu ?@#rage ?@#windows ?@#snowz# ?#boss @#corecontrol ?#scannerx ?@#s ?@#r# ?@#p ?#ngrz ?@##scaninfo## #hangout

here is a link to some the files obtained from there rooted server and various info reguarding the control methods

http://www.exposedbotnets.com/2013/10/2038120410514k-linux-bots-hosted-in.html

controllers home ip which is connectd to host
* [M] (~root@109-207-53-46.ronus.pl): root
[07:40] Quit:st0n3d (st0n3d@91.121.161.52) quits (User has been permanently banned from CoreIRC (no reason)) (7:40pm)

Rude memo sent from buser
 (01:09:04) -MemoServ- Why are you fucking with x00's net? x00 is away at school. Those guys did nothing to you. You should have his net removed from pig's blog, and leave us alone. We dont care that you sent ovh some mail about rooted servers and malware. We will just use other servers we have 1000s of them. We can play this game too....

       hope you can get your customers under control.thanx :)