We initially thought we were the first ones. However, after digging through some literature, we discovered that first tests were already done in 2018 [2]. Though, for some reason, no vulnerable resolvers were discovered. In a paper from 2020 [1], closed resolvers were again tested by IP spoofing internal IP addresses. The numbers from this paper are roughly the same as ours.