raphidae report - storm, defocus/igneel

Hi [redacted],

We got an abuse notification from our Provider saying that your Container :115::/64 IPv6 Subnet was involved in a BotNet, thus part Criminal Intent.

We had no option to suspend your VPS Server, or have the whole server taken offline.


--- Complaint ---

Dear Sir, Madam,

Recently we have identified an abusive botnet on the EFNet IRC network.
These bots jump on nicknames first freed by denial of service traffic to
clients and servers of our network. They seem to connect from your IP
range(s), attached is a log of the IPv6 addresses/ranges in question.

A system in your network may be compromised, or you may have an abusive
customer. Would you please take a look?

Thank you in advance.

'raphidae'
Server Administrator; irc.mediamonks.net
Server Operator; irc.mzima.net, efnet.port80.se, irc.rizon.so


[30/01/15][17:25:43] ••• igneel is defocus@lag.storm.sx * defocus
[30/01/15][17:25:43] ••• igneel is on 7 channels
[30/01/15][17:25:43] ••• igneel is on: #zombie¹ #vps #troll #null
#maryjane
#efnet2 #ebola
[30/01/15][17:25:43] ••• igneel is using irc.inet.tele.dk Better
than WoW
[30/01/15][17:25:43] ••• igneel is actually 2a02:e00:fffb:115::2000
[30/01/15][17:02:14] ••• zombie is solar@2001:1b40:3600:100:0:2:afae:1d26
*
don't whois me, whois defocus
[30/01/15][17:02:14] ••• zombie is on 17 channels
[30/01/15][17:02:14] ••• zombie is on: #exploits #root #malicious
#ebola #null
#nyc #heroin #mdma #syn #troll
[30/01/15][17:02:14] ••• zombie is on: #e #opiate #phear #juped
#antisec #evil
#abuse
[30/01/15][17:02:14] ••• zombie is using efnet.port80.se MARK
MY WORDS!
[30/01/15][17:02:14] ••• zombie is actually 2001:1b40:3600:100:0:2:afae:1d26
User efnet.port80.se rnyr mad 2001:1b40:3600:100:0:2:c9e:ac69
2001:1b40:3600:100:0:2:c9e:ac69 mad
User efnet.port80.se nsa terror 2001:1b40:3600:100:0:2:afae:1d26
2001:1b40:3600:100:0:2:afae:1d26 GOT HACKED
User efnet.port80.se exploit never 2001:1b40:3600:100:0:2:125:af28
2001:1b40:3600:100:0:2:125:af28 It will be a one sided annihilation.
User efnet.port80.se uhdj high 2001:1b40:3600:100:0:2:9ed1:6753
2001:1b40:3600:100:0:2:9ed1:6753 high
efnet.port80.se End of TRACE

Regards,
[redacted]