[dsharlet]

TP-link is clearly ignoring many of the instructions from NTP: http://www.pool.ntp.org/vendors.html

Notably, they are ignoring the ones that make it possible for NTP to be aware of the problem in the first place. Right now, TP-link's traffic probably just looks like millions of unrelated devices misconfigured. NTP wants vendors like this to make requests to a particular subdomain so they can identify problematic vendors in the first place.