So I have been seeing a few instances of SEP IPS blocking outgoing Blackhole Toolkit traffic out to 12.238.253.103 which resolves to wwb.hollandandbarrett.com.  Anyone know of ways to confirm if this host has been compromised and may be receiving feeds from other bots?

Thanks for any assistance.

Sadly I do not have access to the tools to give me packet captures :-(.  I don't even think those that do have the access actually are capturing packets.  I did send an email to the webmaster of the supposed valid site but did not get a response.  The traffic to the site has since stopped, I imagine the powers-that-be put the IP and site in the RBL.  I'm sure there will be more systems like this in the future.