Here's the culprit: http://www.pool.ntp.org/scores/209.132.176.4 I'm happy that the pool can weed these guys out. Now, if only NTP would query the IP periodically at certain events, such as when coming back from stand by, when a server is a frequent false ticker or unreachable...