the U.S. DOJ recently sent out letters to RIR block owners about IP addresses in their space that were likely infected. According to many of the recipients of those letters on NANOG (http://markmail.org/message/vflinfbyu5k4bbmc), the IP addresses were their recursive DNS servers....