Celer Network's initial analysis shows that there was suspicious DNS activity at 7 PM on August 17.