the isp has me logged at 14gb total usage yesterday, including 1.61 down/.19 up when i had the modem disconnected overnight.

my exact total usage according to my router was 2.35 gb downloaded & 1.06 gb uploaded, between 13:00 and 23:59.

i can't jump to the spoofed address yet, but we're another day from disproving the ddos attack as the cause of this. see, i don't know when that 14 gb is being logged. 

....although, i suppose it's hard to cram 12 gb into the 6 or 7 hours that happened before i renewed, given that bandwidth from 2:00-8:00 is counted separately.

it's pretty clear that i got cloned. but, i need to be rigorous.