sql query question...

Here is a snippet of my query.....

select top 500 MAX (distinct userip), count(*) as hits, username, sum( convert( bigint, bytecount))/1024 as bytecount_MB, 0 as blocks
from webproxy.dbo.transactionsunday
group by userip, username
union select distinct userip, 0 as hits, username, 0 as bytecount_MB, count(*) as blocks
from webproxy.dbo.transactionsunday
where status = '403'
group by userip, username

How can I get the same 500 userips from the first part, queried in the second part?