Hi,

I know it's Friday night but I'm in a real pickle:

I'm a small time web developer hosting about 20 sites on a Net24 VPS (Centos/Plesk). The largest of these is for a charitable organisation I'm connected with (webmaster and former cuncil member) - Permaculture in New Zealand Inc. It's a Drupal 7 site.
Typically for a NZ-based VPS, it has unlimited NZ traffic and 15GB/m International traffic, which has been fine until recently.

We've had a longstanding problem with bots trying to sign up for the site (although even when they were getting in, most never posted any spam). The BOTCHA module (a honeypot) now manages to keep our database unsullied, but of course that still results in two full pages being served for each attempt.

I was belatedly alerted (by way of unpaid additional invoices that I didn't notice arrive) to the fact that International Traffic has crept, then soared over the server limit. Currently approaching 50GB/month. It's all hitting the permaculture site. There seem to be requests for a wide range of resources - even the 404s are over 10GB worth. Outbound is heavily exceeding inbound.

While there is an independent traffic monitoring system which gives some real-time information, neither the Virtual container nor Plesk seem to be able to distinguish between local and overseas traffic. 

I have now suspended the site while I seek a solution.

Although I've worked for a hosting company in the past, I'm not a sysadmin, and am thoroughly out of my depth.

Does anyone feel like lending a helping hand, pro-bono?

 skype is dramatic_design