> I think most likely a DDOS by a random part

Agreed, but I would think a DDOS would be observable from the neighbouring (and even not-so-neighbouring) networks/systems.

Reporting an attack based on Dyn saying "under duress/consistent with DDOS" is just shitty, shitty journalism.