I say we get IP address information on the botnet and execute take-downs of the servers by notifying ISPs that server with IP xx.xx.xx.xx is involved in a DDoS attack, etc.?
How about it, slush, can we have a list of IP addresses from your server logs?
+1, although it's probably a botnet

Thus the reason to involve a lot of users who have telephones in multiple countries to call ISP's after doing a reverse host lookup and finding the hosting provider by IP address, then asking them to disable the server because it's active as part of a botnet DDoS... do I have to spell out the whole thing?