It tends to look that way for the port, but I am not experienced with Netstat. Both those addresses are from different countries (UK & USA).
Whenever you come across strange greedy behaviour like that where they are trying to download 'everything' they can, (1) ban/block their ip address in the program you are using, (2) report them to me, perhaps privately via PM if necessary.

Something I reported 12 months ago in a private section of the forum was that after I blocked certain main ip ranges of the UK, I no longer received 'any' spam (with the rare odd exceptions). I was not sure of the co-relationship between the UK and elsewhere but suggested something there. I did that as a test btw & was not a permanent block but lasted 2-3 months.

And yes I found UK to be a high percentage upload sucker for files in a similar fashion. (this was the very reason I tested the blocks, but had no idea it would have such a side-effect to block out spam also.)


One issue is that some hosts might be using proxies and return with a totally different address the next day, perhaps an address originating from a different country.

I haven't been thinking much on this topic for a while because it seemed not too many people were interested in the blocklists I was putting together which took a lot of my time to do overall including the analysing, checking for static or dynamic status, comparing, adding to initial research lists and then if necessary to multiple output lists, etc.