Hello Jaeson,

I like the analysis and the value of pDNS - however something still puzzles me in your analysis.

Looking at
http://blogs.cisco.com/wp-content/uploads/Screen-Shot-2013-06-12-at-3.43.54-PM.png . If the malware originators were using changeip.com for roaming IP address, what is shown in screenshot seems more like time based sensing gap. Changeip.com does not provide you location/based or source based answers. It looks like it is most likely the gaps in sensing time based (2011-10-22 to 2012-0307 blanket time that did not captured the shorter time period in which ynsc.phmail.us was actually providing answers for those 3 valid routable IP addresses).

You have more context with the name servers during that time and various other factors which I am missing. Your response will surely be enlightening.

Vijay