I have an IP range 216.182.228.* (Amazon Development Centre South AFrica) that is just hammering my forums day after day.
On a windows server is their something like htaccess that I can use to ban them?
Andy
H-SPHERE
You may create a support ticket for windows team to review if they can offer you this server side. Else you may create a small patch for your forums that extracts first three octets and based on match with this, denies/allows access.
Send us a request we can put it in block on windows server 
It’s actaully not Amazon but SMBot from Specific Media, Inc.
They are datamining for advertisers.
Their are using Amazon’s ECC service.
If all the domains are getting hit like mine then they are chewing up the servers… they have been 24/7 20-50 IPs for weeks now.
I’ll put in a ticket a little later. (Although I might have to do it again later. Win7 is consistently having performance issues and I’m going to move my domain to a new server soon)
Andy
if you run a site that would have initials like dml.com (you will know if it is yours)
this may be why, as that site is using over 50% of the CPU.
speaking of that, it will help win7 to get these IPs banned, please confirm that is your site 
actually nm, i see you linked to it this vbSEO just gave it an odd title, going to ban away right now!
they are banned now and already seeing an improvement speedwise on the whole of server, lets hope that stays. Also let me know if you see this again, its rather easy to ban all 50 of their IPs
Edit: its staying fast, wow how did I not see this before, I was looking everywhere for why it suddenly was taking so much cpu after being there years!
Got my hopes up a bit to much, thats not 100% resolved, it was great for 30 minutes however, which leads me to the next thing, are they jumping IPs now
Yes the DML is my site.
I have not seen the forums run that fast for a while. They must have really been hitting the site. Some of their IPs are still on there.
I think they have the whole block.
I am banning that whole /20 (only from your site right now), will see if it helps.
Banned, and suddenly fast again, I will be keeping an eye on this site for such again, I wonder if amazon.com needs to be alerted of abuses like this in their “compute cluster”, this surely can’t be good for them.
Now I know why I could not see these hits that caused the issue, you have an application directory that was running in another pool. I have just merged them to one for better monitoring, that will result in slowdown for a few seconds while it recompiles the asp.net.
My members are all ready mentioning the speedup.
I was surprised that the forums ran when I put them in the subdirectory. I don’t remember asking that directory to be made a net application. I assumed since the main domain was a Net application that it just flowed to the sub directories.
In about a month the main domain is going to all net also. The main domain and the forums need to share the same web.config. (there will be some shared keys so I can log in forum members on the main website)
Is how it is setup now correct?
Andy
I’m an Amazon ECS developer and known to the ECS team. I’m going to bring it up on their forums.
I’m a little pissed off. If you guys would’ve seen my CPU useage without seeing that it was this Bot you probably would’ve shut down my forums.
I think you guys ought to consider banning them completely everywhere. This bot had didn’t even look at my robots.txt and at times had 50+ ips grabbing pages as fast as it could.
I’ve been b***ing for weeks now at whoever was causing the Win7 slowdowns and it turns out to be me.
Andy
would not exactly call it you, you can’t control out of line bots so much when they have so many ips.
I will surely keep this in mind for the future, it was a mystery and real pain.
it is nearly like a ddos at times we’d be working and its perfect, then it would freeze up for 20 sec,. recover and be fine.
Stephen,
Amazon is taking this seriously since it is their servers the IPs came from.
I have been asked to privately describe to them what happened. If asked can I refer them to you to let them know what you saw with the server load?
Andy