Webmasters Stack Exchange is a question and answer site for pro webmasters. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We serve a 13mb download which is reasonably popular, around 150-300 downloads a day.

Today we have had 1,200 downloads and as I browse the logs I find they all originate from the same IP address. GeoIP says it originates from Russia, Moscow although that may be inaccurate.

A new download is being requested currently every 6 seconds. Google analytics is not showing any signs of heavy traffic.

Are we being attacked? The server is coping fine, but it's going to soak all our bandwidth up. Is that the purpose of it?

On http://www.projecthoneypot.org the IP is showing as "detected behavior from the IP address consistent with that of a mail server and dictionary attacker".


I've blocked the IP via IIS, this single IP was responsible for ~500 downloads. I suspect a couple more IP's but will allow them for now and keep a close eye on it.

Edit2: 3 IP's from same city responsible >1000 downloads over the last few days.

share|improve this question
Whats are they downloading? – Sevki Jul 28 '11 at 12:33
up vote 3 down vote accepted

Could you have a competitor interested in putting you offline?
Are they idiots (and russia based) or could they being paying some idiot from russia?

If not, then maybe you're getting hits from a single router in some educational or governmental institution in which you suddenly became popular.

What are you checking their ip with? Try maxmind.
Its resolver usually gives some insights of large institutional networks.

What is your product? Is it a game?
They could be doing some serious lan partying up there.

  • Offer a bittorrent option,
  • or move the file to rapidspread/rapidshare/megaupload/rapidsomething
share|improve this answer

I think that it isn't attack. If that Russian guy wanted to attack you, he did it very poorly.

Blocking his IP on firewall is fastest, however dangerous way for another potentional clients

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.