@stefano how is your dns server? for some of my sites, I have my own dns, and there has really been strange traffic. on the dns server, if they can't get at it any other way, they send flawed queries until they are blocked. fortunately, bind9 has a default to only allow a reasonable number of queries - so they pile on the addresses, as I had shown from my logs earlier this month