Has anyone observed the string “getcacheddhcpresultsforcurrentconfig” before? It is one of the most queried for top level domains by many different source addresses. My suspicion is that is configured as a search domain in some (equivalent of) resolv,conf on a widespread device. Thanks Roy Arends