[LinuxBender]

They have some management daemons listening. [1] That could be how they were compromised. Did you try emailing all the addresses listed on this page? [2]

[1] - https://www.shodan.io/host/162.0.229.161

[2] - https://bgp.he.net/ip/162.0.229.161#_whois