Comment by jacquesm

> Both Hetzner and Linode network appear to be reconfigured specifically for this kind of attack for the XMPP service IP addresses

This suggests a compromise of Hetzner and Linode network management.