This sounds like an inherently solvable problem. Start making mirrors that blacklist Amazon/AWS IP ranges.