If you're really actually in a bind, drop me a line (email's in profile). I'll give you a hand. If you're looking for advice on how to mitigate this yourself:

If you're really actually in a bind, drop me a line (email's in profile). I'll give you a hand. If you're looking for advice on how to mitigate this yourself: - apachetop is a useful tool for this sort of thing, and since the activity is occurring on a single site, it should be easy to use. (Assuming of course you use apache.) - If it's an actual botnet, you'll need to pick some honeypot URLs -- links that regular customers aren't hitting but the botnet is -- and then use something like Fail2Ban to pipe accesses to those URLs into iptables bans. - If it's a crawler, it should be from a limited set of IPs and a quick iptables rule addition will fix you up. For reference, here are two easy-to-use rules: iptables -A INPUT -s <source_ip_address> -j DROP iptables -A INPUT -m iprange --src-range <source_ip_range> -j DROP The first rule will add a "drop" command to your INPUT table for any traffic coming from <source_ip_address>. The second rule will allow you to quickly drop a range of IP addresses; <source_ip_range> should look something like "10.0.0.1-10.0.1.255", and "iprange" is a literal.