The CMU Tor exit is seeing about 66 packets/second worth of this (10000 packets, 1151 unique IPs in 149.5 seconds). I don't have time to dig any deeper right now, but on the theory that it's a botnet doing click fraud, I'll pass this along to our cybercrime people. zw