which is a very large number of clients all making ANY requests for isc.org.
The problem is that a lot of the source addresses are within our network, suggesting that we either have a lot of infected customers, or they're spoofed and someone is targeting our customers with unsolicted dns responses.