Perhaps the attackers are drawn to sites they believe will later publicly document the attack, to learn whatever they can on how the operations team responded.