We have been paged 3 times for this and it resolves before I can see what's up.
At the moment I see the following serious users:
root@tools-bastion-03:~# host 10.68.20.221 22.214.171.124.in-addr.arpa domain name pointer mwoffliner4.mwoffliner.eqiad.wmflabs. root@tools-bastion-03:~# host 10.68.16.103 126.96.36.199.in-addr.arpa domain name pointer maps-tiles3.maps.eqiad.wmflabs. root@tools-bastion-03:~# host 10.68.16.70 188.8.131.52.in-addr.arpa domain name pointer maps-wma1.maps.eqiad.wmflabs.
But none of them are doing anything abusive afaict.