This website has no political affiliation; completely unbiased research. Their conclusion:
"The IP addresses that DHS provided may have been used for an attack by a state actor like Russia. But they don’t appear to provide any association with Russia. They are probably used by a wide range of other malicious actors, especially the 15% of IP addresses that are Tor exit nodes.
The malware sample is old, widely used and appears to be Ukrainian. It has no apparent relationship with Russian intelligence and it would be an indicator of compromise for any website."
It's not really a surprise that google.com is more popular than aggregating all queries for the entire .org TLD; I'm sure we'll get more interesting analyses out of this.
It is not so simple. Often you like some hardware and want to buy it but you get no option of getting it with GNU/Linux or at least without paying for Windows which you will then replace with GNU/Linux anyways. You can choose other laptops but often they don't offer what you want, hardware wise.
"The IP addresses that DHS provided may have been used for an attack by a state actor like Russia. But they don’t appear to provide any association with Russia. They are probably used by a wide range of other malicious actors, especially the 15% of IP addresses that are Tor exit nodes. The malware sample is old, widely used and appears to be Ukrainian. It has no apparent relationship with Russian intelligence and it would be an indicator of compromise for any website."