This is coupled with extensive logging of DNS queries. If you connect to IP xxx.xxx.xxx.xxx a few milliseconds after looking up the IP for badsite.com then you

This is coupled with extensive logging of DNS queries. If you connect to IP xxx.xxx.xxx.xxx a few milliseconds after looking up the IP for badsite.com then you're probably connecting to badsite.com. Then they can get a warrant for badsite.com's web server logs, or cloudflares logs if badsite.com is using it...