[forbiddenlake]

The HN title[1] was editorialized. The actual figure, used twice in the article, specifies it is talking about data center networks monitored by Akamai.

[1] As of this comment: "Spoofing DNS records abusing Microsoft DHCP server running in 40% of datacenters"

[Terretta]

I'd argue it's more likely to be in a datacenter than in 40% of data center networks, since if even one network in the colo ran it, that would mean it was in that datacenter.

Remember, this isn't server share, it's share of DCs that have even one Windows Server with AD and Microsoft DHCP. For large commercial colos, you can assume that's effectively 100% of colos.

And with 85% of SMB being Microsoft shops, one can extrapolate for small colos, though we'd hope of that majority that are still on AD they either use Azure AD or run AD in the office and Linux in the colo.