Every .dk domain whose web server address has the reverse-DNS (PTR) name evilcorp.dk, which usually identifies one physical or virtual hosting server. Data comes from our own scanners, which re-resolve every .dk domain in the zone roughly once a week.