If a single IP produces that much traffic to a build system, and is an external resident IP...it's 100% either a DDoS attempt or a malicious actor that is in th

If a single IP produces that much traffic to a build system, and is an external resident IP...it's 100% either a DDoS attempt or a malicious actor that is in the process of exfiltrating data. There's not a single scenario where a traffic this size to an internal buildbot machine to/from a single unknown resident IP is legit.