<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Hi Thomas,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
You could simply use GeoIP Blocking to filter out any traffic from China. Here's a link to achieve this for Apache: <a href="https://www.cloudibee.com/geoip-based-country-blocking-for-apache/" id="LPlnk">https://www.cloudibee.com/geoip-based-country-blocking-for-apache/</a>.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Regards,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Christopher Hawker</div>
<br>
<div>
<div id="appendonsend"></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size: 11pt;"><b>From:</b> CentOS-mirror <centos-mirror-bounces@centos.org> on behalf of Thomas Enos <thomas.enos@afghan-wireless.com><br>
<b>Sent:</b> Tuesday, 6 October 2020 4:34 AM<br>
<b>To:</b> Mailing list for CentOS mirrors. <centos-mirror@centos.org>; CEDIA FOSS Mirrors <mirror@cedia.org.ec><br>
<b>Subject:</b> Re: [CentOS-mirror] [Ticket#2020100504000801] Potential DOS attack against a mirror</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText">We can confirm being hit by 27.221.66.0/24 pulling the same iso as well. What action was taken to address this by your networks?<br>
<br>
Thanks,<br>
<br>
From: CentOS-mirror <centos-mirror-bounces@centos.org> on behalf of Bogdan-Stefan Rotariu <bogdan.rotariu@chroot.ro><br>
Reply to: "Mailing list for CentOS mirrors." <centos-mirror@centos.org><br>
Date: Monday, 5 October 2020 at 9:30 PM<br>
To: CEDIA FOSS Mirrors <mirror@cedia.org.ec>, "Mailing list for CentOS mirrors." <centos-mirror@centos.org><br>
Subject: Re: [CentOS-mirror] [Ticket#2020100504000801] Potential DOS attack against a mirror<br>
<br>
[EXTERNAL EMAIL] This is an external email, please make sure the sender is well known before clicking on any link or opening an attachment, if spam report it to CIRT@afghan-wireless.com<br>
<br>
Hi there,<br>
<br>
On Oct 5, 2020, at 20:24, CEDIA FOSS Mirrors via CentOS-mirror <centos-mirror@centos.org> wrote:<br>
hi<br>
<br>
<snip><br>
<br>
112.95.214.226 - China Unicom Guangdong province network<br>
223.88.61.170 - China Mobile Communications Corporation<br>
171.41.7.29 - CHINANET Hubei province network<br>
120.84.10.190 - China Unicom Guangdong province network<br>
27.221.66.104 - China Unicom Shandong province network<br>
27.221.66.105 - China Unicom Shandong province network<br>
112.32.21.93 - China Mobile Communications Corporation<br>
27.221.49.135 - China Unicom Shandong province network<br>
<br>
Have you noticed that in your mirrors? look for these IP and notice if they have been trying to continously download iso<br>
<br>
We did encounter the same issues with the same IP addresses and same iso file. Till now I thought it was an isolated issue..<br>
<br>
—<br>
Bogdan-Stefan Rotariu<br>
CTO,Founder<br>
Chroot Network SRL<br>
WEB: <a href="http://www.chroot.ro<http://track.chroot.ro/?a=10395&m=&n=&s=12c000000d625fc&u=http%3a%2f%2fwww.chroot.ro%3futm_source%3d%26utm_medium%3demail%26utm_campaign%3dunspecified&t=&e=contact%40chroot.ro&h=8a6c74da">
http://www.chroot.ro<http://track.chroot.ro/?a=10395&m=&n=&s=12c000000d625fc&u=http%3a%2f%2fwww.chroot.ro%3futm_source%3d%26utm_medium%3demail%26utm_campaign%3dunspecified&t=&e=contact%40chroot.ro&h=8a6c74da</a>><br>
Phone: +40-731-247-668<tel:+40-731-247-668><br>
Suport tehnic: suport@chroot.ro<<a href="mailto:suport@chroot.ro">mailto:suport@chroot.ro</a>><br>
Suport vanzari: vanzari@chroot.ro<<a href="mailto:vanzari@chroot.ro">mailto:vanzari@chroot.ro</a>><br>
Contact general: contact@chroot.ro<<a href="mailto:contact@chroot.ro">mailto:contact@chroot.ro</a>><br>
<br>
_______________________________________________<br>
CentOS-mirror mailing list<br>
CentOS-mirror@centos.org<br>
<a href="https://lists.centos.org/mailman/listinfo/centos-mirror">https://lists.centos.org/mailman/listinfo/centos-mirror</a><br>
</div>
</span></font></div>
</div>
</body>
</html>