This is a very good point. It looks like all of these were only listed after they became public as part of the attack. So it's not like they were known bad IPs

This is a very good point. It looks like all of these were only listed after they became public as part of the attack. So it's not like they were known bad IPs before. As an example, here is the Spamhaus entry for one of the IPs. Notice the references to articles about the Sony hack: http://www.spamhaus.org/sbl/query/SBL242808 http://www.spamhaus.org/sbl/query/SBL242808