<!DOCTYPE html><html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"/></head><body style="font-family:Geneva,Helvetica,Arial,sans-serif; font-size: 12px;"><br />
<br />
10/05/2020 12:40 - Thomas Enos wrote:
<div style="border:none; border-left:solid blue 1.5pt; padding:0cm 0cm 0cm 4.0pt" type="cite">We can confirm being hit by 27.221.66.0/24 pulling the same iso as well. What<br />
action was taken to address this by your networks?<br />
</div>
<br />
hi Thomas<br />
there are several approaches that could be taken:
<ol>
<li>block the whole country (using geoiplookup)</li>
<li>block the whole country from downloading iso files</li>
<li>block the list of IPs</li>
<li>If the attacks persist from other IPs, then it is advisable to create a list of IPs we can use here to share IPs trying to dos our mirrors. This way everybody could use the list to block connections from them.</li>
</ol>
other suggestions are welcome<br />
regards<br />
epe<br />
<br />
<div style="border:none; border-left:solid blue 1.5pt; padding:0cm 0cm 0cm 4.0pt" type="cite"><br />
<br />
Thanks,<br />
<br />
From: CentOS-mirror <centos-mirror-bounces@centos.org> on behalf of Bogdan-Stefan<br />
Rotariu <bogdan.rotariu@chroot.ro><br />
Reply to: "Mailing list for CentOS mirrors." <centos-mirror@centos.org><br />
Date: Monday, 5 October 2020 at 9:30 PM<br />
To: CEDIA FOSS Mirrors <mirror@cedia.org.ec>, "Mailing list for CentOS mirrors."<br />
<centos-mirror@centos.org><br />
Subject: Re: [CentOS-mirror] [Ticket#2020100504000801] Potential DOS attack<br />
against a mirror<br />
<br />
[EXTERNAL EMAIL] This is an external email, please make sure the sender is well<br />
known before clicking on any link or opening an attachment, if spam report it to<br />
CIRT@afghan-wireless.com<br />
<br />
Hi there,<br />
<br />
On Oct 5, 2020, at 20:24, CEDIA FOSS Mirrors via CentOS-mirror<br />
<centos-mirror@centos.org> wrote:<br />
hi<br />
<br />
<snip><br />
<br />
112.95.214.226 - China Unicom Guangdong province network<br />
223.88.61.170 - China Mobile Communications Corporation<br />
171.41.7.29 - CHINANET Hubei province network<br />
120.84.10.190 - China Unicom Guangdong province network<br />
27.221.66.104 - China Unicom Shandong province network<br />
27.221.66.105 - China Unicom Shandong province network<br />
112.32.21.93 - China Mobile Communications Corporation<br />
27.221.49.135 - China Unicom Shandong province network<br />
<br />
Have you noticed that in your mirrors? look for these IP and notice if they have<br />
been trying to continously download iso<br />
<br />
We did encounter the same issues with the same IP addresses and same iso file.<br />
Till now I thought it was an isolated issue..<br />
<br />
—<br />
Bogdan-Stefan Rotariu<br />
CTO,Founder<br />
Chroot Network SRL<br />
WEB:<br />
<a href="http://www.chroot.ro" target="_blank" title="http://www.chroot.ro">http://www.chroot.ro</a><<a href="http://track.chroot.ro/?a=10395&m=&n=&s=12c000000d625fc&u=http%3a%2f%2fwww.chroot.ro%3futm_source%3d%26utm_medium%3demail%26utm_campaign%3dunspecified&t=&e=contact%40chroot.ro&h=8a6c74da" target="_blank" title="http://track.chroot.ro/?a=10395&m=&n=&s=12c000000d625fc&u=http%3a%2f%2fwww.chroot.ro%3futm_source%3d%26utm_medium%3demail%26utm_campaign%3dunspecified&t=&e=contact%40chroot.ro&h=8a6c74da">http://track.chroot.ro/?a=10395&m=&n=&s=12c000000d625fc&u=http%3a%2f%2fwww.[..]</a>><br />
Phone: +40-731-247-668<tel:+40-731-247-668><br />
Suport tehnic: suport@chroot.ro<mailto:suport@chroot.ro><br />
Suport vanzari: vanzari@chroot.ro<mailto:vanzari@chroot.ro><br />
Contact general: contact@chroot.ro<mailto:contact@chroot.ro><br />
</div></body></html>