3 ms·I'm guessing they did a whois on the domains linked to the attack.by mywittyname 7y agoI'm guessing they did a whois on the domains linked to the attack.