] About 70 percent of all the queries were either
] identical, or repeat requests for addresses within the
] same domain. About 12 percent of the queries received by
] the root server on Oct. 4, were for nonexistent top-level
] domains. In addition, 7 percent of all the queries already
] contained an IP address instead of a host name.

All bad code and misconfigured firewalls.

Unnecessary Traffic Saturating A Key Internet 'Root' Server