I've tried localhost redirects, doesn't impact the speed of their requests, all ports are closed on the suspect machines