Did_Nobody_See

We recently obtained a triage image from a Windows laptop belonging to a suspected ransomware operator. The suspect used several anti-forensic techniques and managed to erase any form of web history. We suspect that we may be able to use data from DNS servers as evidence to tie the suspect to the operation. Unfortunately, the suspect was using a VPN. Can you find any DNS servers used during the VPN connection?

The answer will be in the form of byuctf{ip.address} (there may be multiple answers, any valid IP address for the DNS server will work for the answer).

Author: FiredPeppers