We serve a 13mb download which is reasonably popular, around 150-300 downloads a day.
Today we have had 1,200 downloads and as I browse the logs I find they all originate from the same IP address. GeoIP says it originates from Russia, Moscow although that may be inaccurate.
A new download is being requested currently every 6 seconds. Google analytics is not showing any signs of heavy traffic.
Are we being attacked? The server is coping fine, but it's going to soak all our bandwidth up. Is that the purpose of it?
On http://www.projecthoneypot.org the IP is showing as "detected behavior from the IP address consistent with that of a mail server and dictionary attacker".
I've blocked the IP via IIS, this single IP was responsible for ~500 downloads. I suspect a couple more IP's but will allow them for now and keep a close eye on it.
Edit2: 3 IP's from same city responsible >1000 downloads over the last few days.