<i>"The servers used in both attacks employ the HomeLinux DynamicDNS provider, and both are currently pointing to IP addresses owned by Linode, a US-based company that offers Virtual Private Server hosting. The IP addresses in question are within the same subnet, and they are six IP addresses apart from each other,"</i><p>Quote attributed to VeriSign's iDefense security lab in <a href="http://arstechnica.com/security/news/2010/01/researchers-identify-command-servers-behind-google-attack.ars" rel="nofollow">http://arstechnica.com/security/news/2010/01/researchers-ide...</a>