A lot of web scraping. The ones that got KimWolf’d were/are doing a lot of DDoS (SYN floods etc).