A quick scan of the top offending IPs from the DNS report in the muug.ca daemon logs reveals the thousands of DNS hits from one of the days resulted in *2* actual web hits. Zero MTA hits. Zero FTP hits. That's basically all we run. (Ok, ntp too, but that doesn't seem to log at the moment.) If this was organic the DNS lookups should result in some actual subsequent traffic, right? At least the tencent abuse botnets we've dealt with before were kind enough to actually abuse the webserver with hits too! (The hit count is higher than Brad's charted indicated because there is another chart for muug.mb.ca that has the same servers hitting us at double the rate! And we've deprecated mb.ca everywhere we could think of to boot, so it should get tiny traffic, not more!)