Not to say that Huthos are innocent, but I don't see any concrete proof that they are behind this attack. The fact that they are hosting a server provisioning script is hardly crazy, given that they are a hosting provider. What's to say that the ACTUAL attacker didn't just come across the provisioning script and decide to use it for themselves? The script URL is listed publicly online: http://yandicunk.blogspot.co.uk/2015/03/cara-setting-dan-ins... & http://huthos.com/tutorial/autoscripthuthos.html
"It also appears that the hackers attack machine may be hosting an unauthenticated web proxy" makes it sound like the attacker owns the machine they were connecting from. IMO, chances are that "49.213.23.171" is just another compromised box.
"It also appears that the hackers attack machine may be hosting an unauthenticated web proxy" makes it sound like the attacker owns the machine they were connecting from. IMO, chances are that "49.213.23.171" is just another compromised box.