[lcampbell]

Here's the writeup from seclists.org: http://seclists.org/nmap-dev/2013/q2/3

It looks like seclists.org and nmap.org are hosted on different IP addresses, but both route to linode, and both have the same WHOIS information, so I think it's safe to say the writeup applies to both.

[scott_karana]

Thanks!

By the sounds of their writeup, the attacks just visited the "highest profile" sites as per the Quora link to obfuscate their real attack.