That log of 10 IP addresses accounting for 100% of DNS requests over a period of 4.5 months (from Krebs) is complete BS. The domain name in question was publicl

That log of 10 IP addresses accounting for 100% of DNS requests over a period of 4.5 months (from Krebs) is complete BS. The domain name in question was publicly known — records available in DomainTools per Ankura report. There's way more background DNS scanning of public names going on, all the time, for there to not be maybe an order of magnitude more requests. It's never even explained where the log comes from in the first place! How convenient! Tried and true diversion tactic: a story that nobody can disprove and which will be believed even if it's denied. Yes, Prime Minister, S2E2, "Official Secrets", ©1987 BBC.