Are we being attacked?

Question

We serve a 13mb download which is reasonably popular, around 150-300 downloads a day.

Today we have had 1,200 downloads and as I browse the logs I find they all originate from the same IP address. GeoIP says it originates from Russia, Moscow although that may be inaccurate.

A new download is being requested currently every 6 seconds. Google analytics is not showing any signs of heavy traffic.

Are we being attacked? The server is coping fine, but it's going to soak all our bandwidth up. Is that the purpose of it?

On http://www.projecthoneypot.org the IP is showing as "detected behavior from the IP address consistent with that of a mail server and dictionary attacker".

Edit

I've blocked the IP via IIS, this single IP was responsible for ~500 downloads. I suspect a couple more IP's but will allow them for now and keep a close eye on it.

Edit2: 3 IP's from same city responsible >1000 downloads over the last few days.

Answer 1

Could you have a competitor interested in putting you offline?
Are they idiots (and russia based) or could they being paying some idiot from russia?

If not, then maybe you're getting hits from a single router in some educational or governmental institution in which you suddenly became popular.

What are you checking their ip with? Try maxmind.
Its resolver usually gives some insights of large institutional networks.
http://www.maxmind.com/app/locate_demo_ip

What is your product? Is it a game?
They could be doing some serious lan partying up there.

• Offer a bittorrent option,
• or move the file to rapidspread/rapidshare/megaupload/rapidsomething

Answer 2

I think that it isn't attack. If that Russian guy wanted to attack you, he did it very poorly.

Blocking his IP on firewall is fastest, however dangerous way for another potentional clients