Ok, this is odd. For some of the machines I admin here as a grad student I'm getting lots of failed logins from 18.104.22.168. Look up the info and you get http://www.hallacycle.com/. (Warning; firefox blocks at least one popup from here.)
It looks like there's a "forum" button that I would like to use to post that their machine's been compromised, but I can't understand the Korean. Ah well.