This is what the packets look like arriving from the vast majority of hosts hitting about every four minutes: lsanca1-ar1-4-62-125-151.lsanca1.dsl-verizon.net -> vitesse HTTP GET / HTTP/1.1 0: 0800 20a1 4ca0 0030 1e05 2758 0800 4500 .. .L..0..'X..E. 16: 0067 e0cd 4000 6b06 055b 043e 7d97 c108 .g..@.k..[.>}... 32: e68a 12bb 0050 499d 661c 4036 f47c 5018 .....PI.f.@6.|P. 48: 4470 8e50 0000 4745 5420 2f20 4854 5450 Dp.P..GET / HTTP 64: 2f31 2e31 0d0a 486f 7374 3a20 666f 7572 /1.1..Host: four 80: 6d69 6c61 622e 6368 0d0a 4361 6368 652d milab.ch..Cache- 96: 436f 6e74 726f 6c3a 206e 6f2d 6361 6368 Control: no-cach 112: 650d 0a0d 0a e.... The hosts with very high hit rates appear to be HTTP proxy servers which are relaying requests from hosts behind them. Here's a dump of a packet from the host at the very top of the heavy hitters report: wc07.wlfdle.rnc.net.cable.rogers.com -> vitesse HTTP GET / HTTP/1.1 0: 0800 20a1 4ca0 0030 1e05 2758 0800 4500 .. .L..0..'X..E. 16: 00ce e6a2 4000 2c06 28f1 42b9 544a c108 ....@.,.(.B.TJ.. 32: e68a b959 0050 0b64 6c2d 798e e202 8018 ...Y.P.dl-y..... 48: 4470 c88b 0000 0101 080a 2e4f 0050 594f Dp.........O.PYO 64: daa9 4745 5420 2f20 4854 5450 2f31 2e31 ..GET / HTTP/1.1 80: 0d0a 486f 7374 3a20 666f 7572 6d69 6c61 ..Host: fourmila 96: 622e 6368 0d0a 436f 6e6e 6563 7469 6f6e b.ch..Connection 112: 3a20 6b65 6570 2d61 6c69 7665 0d0a 5072 : keep-alive..Pr 128: 6167 6d61 3a20 6e6f 2d63 6163 6865 0d0a agma: no-cache.. 144: 582d 466f 7277 6172 6465 642d 466f 723a X-Forwarded-For: 160: 2032 342e 3135 332e 3539 2e38 340d 0a56 24.153.59.84..V 176: 6961 3a20 312e 3020 7763 3037 2028 4e65 ia: 1.0 wc07 (Ne 192: 7443 6163 6865 204e 6574 4170 702f 352e tCache NetApp/5. 208: 322e 3152 3144 3929 0d0a 0d0a 2.1R1D9).... As you can see, this is a proxy server forwarding a packet for a host with IP address 24.153.59.84, which resolves to CPE00e0184e28fb-CM00803785d6b6.cpe.net.cable.rogers.com, another host in the same domain (albeit a very different IP address: the proxy server is 66.185.84.74). Monitoring packets from the proxy server show it forwarding requests from an assortment of hosts behind it. The "Pragma: no-cache" so nicely specified in the request forces the proxy server to hit my site every time a client behind it does.