It is common to see attacks hop from provider to provider. A target (like a High Yield Investment Program, a pro-choice website, online casino, etc) will be us

It is common to see attacks hop from provider to provider. A target (like a High Yield Investment Program, a pro-choice website, online casino, etc) will be using ProviderA and the attackers will hit their DNS in an attempt to take the site down. The target will want to get back online (or get terminated by ProviderA) and jump over to ProviderB. The attackers see the change, and take down the new provider. Rinse and repeat forever. On the backend most of the large DNS providers share a common blacklist of sites they have terminated so you can't just provider hop and drag the attack around with you. I don't think DNSimple or Zergio participates, though.