[keidian]

It seems HTP went after nmap.org machines, so I'm guessing that woudl be the directed customer they picked?

[scott_karana]

Do you have a chatlog or citation?

I'm not arguing, I'd love to read it! :)

[lcampbell]

Here's the writeup from seclists.org: http://seclists.org/nmap-dev/2013/q2/3

It looks like seclists.org and nmap.org are hosted on different IP addresses, but both route to linode, and both have the same WHOIS information, so I think it's safe to say the writeup applies to both.

[scott_karana]

Thanks!

By the sounds of their writeup, the attacks just visited the "highest profile" sites as per the Quora link to obfuscate their real attack.