What’s also very interesting is that the report appears to mention that they observed traffic stemming from this problem but did not appear to investigate it much: 5.4.5 Name includes _ldap or _kerberos at the lowest level Patterns observed show many requests of one of the forms: _ldap._tcp.dc._msdcs.