DoS Style Malformed GETs From Ronzoo.com

Has anyone else here experienced a 24 hour barrage of malformed GETs with "ronzoo.com" showing in the Agent or Referrer log entries. At first it looks like a genuine search engine spider, with a GET to the default "robots.txt" which is then followed by a 18 to 24 hour barrage of malformed GET requests coming in at the rate of 7,500 to 8,000 a minute.

The malformed GET takes the form of:

[url]

The above is just an example - but the resultant 404 error then shows just the "Go" part. In the original request you sometimes see "ronzoo.com" in the referrer.

These started showing up on the 27th January and are continuing every 2 or 3 days. The source IP addresses are changing between RoadRunner and Hughs.Net DSL accounts, three examples:

70.121.44.37
69.19.14.37
66.82.9.49

We have had 18 attacks - which is really what they are - across a number of different servers we own and operate - against popular websites owned by our clients. The worst lasted 36 hours before we were able to block the source IPs at our perimeter firewall. The shortest attack lasted 5 hours.

We have alerted the relevent ISP's but would be interested if anyone else here has seen this in their logs.