<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hello,</p>
<p><br>
</p>
<p>We also had the same problem and blocked China. Problem solved.</p>
<p><br>
</p>
<div class="moz-cite-prefix">6.10.2020 01:23 tarihinde Christopher
Hawker yazdı:<br>
</div>
<blockquote type="cite"
cite="mid:ME3P282MB100936CFF8B3552A76EC3377820C0@ME3P282MB1009.AUSP282.PROD.OUTLOOK.COM">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif;
font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255,
255, 255);">
Hi Thomas,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif;
font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255,
255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif;
font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255,
255, 255);">
You could simply use GeoIP Blocking to filter out any traffic
from China. Here's a link to achieve this for Apache: <a
href="https://www.cloudibee.com/geoip-based-country-blocking-for-apache/"
id="LPlnk" moz-do-not-send="true">https://www.cloudibee.com/geoip-based-country-blocking-for-apache/</a>.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif;
font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255,
255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif;
font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255,
255, 255);">
Regards,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif;
font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255,
255, 255);">
Christopher Hawker</div>
<br>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif;
font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size: 11pt;"
face="Calibri, sans-serif" color="#000000"><b>From:</b>
CentOS-mirror <a class="moz-txt-link-rfc2396E" href="mailto:centos-mirror-bounces@centos.org"><centos-mirror-bounces@centos.org></a> on
behalf of Thomas Enos
<a class="moz-txt-link-rfc2396E" href="mailto:thomas.enos@afghan-wireless.com"><thomas.enos@afghan-wireless.com></a><br>
<b>Sent:</b> Tuesday, 6 October 2020 4:34 AM<br>
<b>To:</b> Mailing list for CentOS mirrors.
<a class="moz-txt-link-rfc2396E" href="mailto:centos-mirror@centos.org"><centos-mirror@centos.org></a>; CEDIA FOSS Mirrors
<a class="moz-txt-link-rfc2396E" href="mailto:mirror@cedia.org.ec"><mirror@cedia.org.ec></a><br>
<b>Subject:</b> Re: [CentOS-mirror]
[Ticket#2020100504000801] Potential DOS attack against a
mirror</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span
style="font-size:11pt">
<div class="PlainText">We can confirm being hit by
27.221.66.0/24 pulling the same iso as well. What
action was taken to address this by your networks?<br>
<br>
Thanks,<br>
<br>
From: CentOS-mirror
<a class="moz-txt-link-rfc2396E" href="mailto:centos-mirror-bounces@centos.org"><centos-mirror-bounces@centos.org></a> on behalf of
Bogdan-Stefan Rotariu <a class="moz-txt-link-rfc2396E" href="mailto:bogdan.rotariu@chroot.ro"><bogdan.rotariu@chroot.ro></a><br>
Reply to: "Mailing list for CentOS mirrors."
<a class="moz-txt-link-rfc2396E" href="mailto:centos-mirror@centos.org"><centos-mirror@centos.org></a><br>
Date: Monday, 5 October 2020 at 9:30 PM<br>
To: CEDIA FOSS Mirrors <a class="moz-txt-link-rfc2396E" href="mailto:mirror@cedia.org.ec"><mirror@cedia.org.ec></a>,
"Mailing list for CentOS mirrors."
<a class="moz-txt-link-rfc2396E" href="mailto:centos-mirror@centos.org"><centos-mirror@centos.org></a><br>
Subject: Re: [CentOS-mirror] [Ticket#2020100504000801]
Potential DOS attack against a mirror<br>
<br>
[EXTERNAL EMAIL] This is an external email, please make
sure the sender is well known before clicking on any
link or opening an attachment, if spam report it to
<a class="moz-txt-link-abbreviated" href="mailto:CIRT@afghan-wireless.com">CIRT@afghan-wireless.com</a><br>
<br>
Hi there,<br>
<br>
On Oct 5, 2020, at 20:24, CEDIA FOSS Mirrors via
CentOS-mirror <a class="moz-txt-link-rfc2396E" href="mailto:centos-mirror@centos.org"><centos-mirror@centos.org></a> wrote:<br>
hi<br>
<br>
<snip><br>
<br>
112.95.214.226 - China Unicom Guangdong province network<br>
223.88.61.170 - China Mobile Communications
Corporation<br>
171.41.7.29 - CHINANET Hubei province network<br>
120.84.10.190 - China Unicom Guangdong province
network<br>
27.221.66.104 - China Unicom Shandong province network<br>
27.221.66.105 - China Unicom Shandong province network<br>
112.32.21.93 - China Mobile Communications
Corporation<br>
27.221.49.135 - China Unicom Shandong province network<br>
<br>
Have you noticed that in your mirrors? look for these IP
and notice if they have been trying to continously
download iso<br>
<br>
We did encounter the same issues with the same IP
addresses and same iso file. Till now I thought it was
an isolated issue..<br>
<br>
—<br>
Bogdan-Stefan Rotariu<br>
CTO,Founder<br>
Chroot Network SRL<br>
WEB: <a
href="http://www.chroot.ro<http://track.chroot.ro/?a=10395&m=&n=&s=12c000000d625fc&u=http%3a%2f%2fwww.chroot.ro%3futm_source%3d%26utm_medium%3demail%26utm_campaign%3dunspecified&t=&e=contact%40chroot.ro&h=8a6c74da"
moz-do-not-send="true">
http://www.chroot.ro<http://track.chroot.ro/?a=10395&m=&n=&s=12c000000d625fc&u=http%3a%2f%2fwww.chroot.ro%3futm_source%3d%26utm_medium%3demail%26utm_campaign%3dunspecified&t=&e=contact%40chroot.ro&h=8a6c74da</a>><br>
Phone: +40-731-247-668<a class="moz-txt-link-rfc2396E" href="tel:+40-731-247-668"><tel:+40-731-247-668></a><br>
Suport tehnic: <a class="moz-txt-link-abbreviated" href="mailto:suport@chroot.ro">suport@chroot.ro</a><<a
href="mailto:suport@chroot.ro" moz-do-not-send="true">mailto:suport@chroot.ro</a>><br>
Suport vanzari: <a class="moz-txt-link-abbreviated" href="mailto:vanzari@chroot.ro">vanzari@chroot.ro</a><<a
href="mailto:vanzari@chroot.ro" moz-do-not-send="true">mailto:vanzari@chroot.ro</a>><br>
Contact general: <a class="moz-txt-link-abbreviated" href="mailto:contact@chroot.ro">contact@chroot.ro</a><<a
href="mailto:contact@chroot.ro" moz-do-not-send="true">mailto:contact@chroot.ro</a>><br>
<br>
_______________________________________________<br>
CentOS-mirror mailing list<br>
<a class="moz-txt-link-abbreviated" href="mailto:CentOS-mirror@centos.org">CentOS-mirror@centos.org</a><br>
<a
href="https://lists.centos.org/mailman/listinfo/centos-mirror"
moz-do-not-send="true">https://lists.centos.org/mailman/listinfo/centos-mirror</a><br>
</div>
</span></font></div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
CentOS-mirror mailing list
<a class="moz-txt-link-abbreviated" href="mailto:CentOS-mirror@centos.org">CentOS-mirror@centos.org</a>
<a class="moz-txt-link-freetext" href="https://lists.centos.org/mailman/listinfo/centos-mirror">https://lists.centos.org/mailman/listinfo/centos-mirror</a>
</pre>
</blockquote>
<div class="moz-signature">-- <br>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
<table style="width: 400px; font-size:9pt;
font-family:Arial,sans-serif; line-height:14px;" cellspacing="0"
cellpadding="0">
<tbody>
<tr>
<td style="font-family:Arial,sans-serif; color:#3e3e3e;
font-size:9pt">İyi Çalışmalar / Best Regards,</td>
</tr>
<tr>
<td style="font-family:Arial Black,sans-serif;
color:#3e3e3e; font-size:13pt; font-weight:bold;
padding-bottom:3px; line-height:20px;"> Cihan Nimsi </td>
</tr>
<tr>
<td style="font-family:Arial,sans-serif; color:#1793ce;
font-size:11pt; padding-bottom:3px; line-height:18px;">C-Level
Executive</td>
</tr>
<tr>
<td style="padding-top:22px;"><a
href="https://www.guzel.net.tr" target="_blank"><img
alt="Logo" style="width:166px; height:auto; border:0;"
src="https://www.guzel.net.tr/templates/guzelv3/images/logo.png"
width="166" border="0"></a></td>
</tr>
<tr>
<td style="padding-top:12px;"> </td>
</tr>
<tr>
<td style="font-family:Arial,sans-serif; color:#3e3e3e;
font-size:9pt;">İçerenköy Mh. Ertaç Sk. Ardil İş Merkezi</td>
</tr>
<tr>
<td style="font-family:Arial,sans-serif; color:#3e3e3e;
font-size:9pt;">No: 4/2 Kat: 1 Ataşehir/İSTANBUL</td>
</tr>
<tr>
<td style="font-family:Arial,sans-serif; color:#3e3e3e;
font-size:9pt;">Telefon +90 850 885 0 558 - 1001</td>
</tr>
<tr>
<td style="font-family:Arial,sans-serif; color:#3e3e3e;
padding-top:18px; font-size:9pt; font-weight:bold;"><a
href="https://www.guzel.net.tr" target="_blank"
rel="noopener" style="text-decoration:none;
color:#3e3e3e;"> www.guzel.net.tr</a> </td>
</tr>
<tr>
<td style="padding-top:22px"><span
style="display:inline-block; height:20px;"><span><a
href="http://www.facebook.com/guzelhosting"
target="_blank"><img alt="Facebook" style="border:0;
height:20px; width:20px"
src="https://www.guzel.net.tr/images/custom/fb.png"
width="20" height="20" border="0"></a> </span><span><a
href="http://twitter.com/guzelhosting"
target="_blank"><img alt="Twitter icon"
style="border:0; height:20px; width:20px"
src="https://www.guzel.net.tr/images/custom/tt.png"
width="20" height="20" border="0"></a> </span><span><a
href="https://www.instagram.com/guzel.hosting"
target="_blank"><img alt="Instagram icon"
style="border:0; height:20px; width:20px"
src="https://www.guzel.net.tr/images/custom/it.png"
width="20" height="20" border="0"></a></span></span>
</td>
</tr>
<tr>
</tr>
<tr>
<td style="font-family:Arial,sans-serif; color:#9b9b9b;
padding-top:16px; text-align:justify; font-size:8pt;">Bu
e-mailin içeriği gizlidir ve sadece bu e-mailin alıcısına
özeldir. Göndericinin izni olmadan bu mesajın 3.
taraflarla paylaşılması yasaktır. Eğer bu e-mail size
yanlışlıkla gönderildiyse, lütfen bu e-maili yanıtlayıp
siliniz, böylece aynı hata tekrar olmayacaktır.</td>
</tr>
<tr>
<td style="font-family:Arial,sans-serif; color:#9b9b9b;
padding-top:16px; text-align:justify; font-size:8pt;">The
content of this email is confidential and intended for the
recipient specified in message only. It is strictly
forbidden to share any part of this message with any third
party, without a written consent of the sender. If you
received this message by mistake, please reply to this
message and follow with its deletion, so that we can
ensure such a mistake does not occur in the future.</td>
</tr>
</tbody>
</table>
</div>
</body>
</html>