Check whois of other domains that are hacked, it seems most of them hosted by same provider.