Silly suggestion: feed them bogus DNS info. See if you can figure out where their DNS requests are coming from.