I say we get IP address information on the botnet and execute take-downs of the servers by notifying ISPs that server with IP xx.xx.xx.xx is involved in a DDoS attack, etc.?
How about it, slush, can we have a list of IP addresses from your server logs?
+1, although it's probably a botnet

Thus the reason to involve a lot of users who have telephones in multiple countries to call ISP's after doing a reverse host lookup and finding the hosting provider by IP address, then asking them to disable the server because it's active as part of a botnet DDoS... do I have to spell out the whole thing?
Good luck with that, taking out the 'drones' is like trying to hold the tide back. For every drone you stop, two or more replace it. To really stop this you need to locate the 'command' nodes and shut those down.