I wonder if this the same hosting provider as the one involved in the Poloniex attack?
My first thought as well, also wonder if it's the same grouped that hacked Poloniex as well. Could just be a copy cat attempt after it was shown how vulnerable hosting providers can be.