Eric looks in the Categorio logs and sees the bogus clients all look like they are authenticated, but with meaningless users and all the exact software version. And it doesn't match any of the versions agents are actually using. It looks like someone has a botnet with a cracked client to create new cat entries. He updates the ticket with the recommendation to allow only known TalkyCo address ranges. Eric uses Meena's incident summary to compose an email for Categorio Support. The workaround is ok, but it really needs a bug fix. And there's still the problem of weird records in the database.