<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
@font-face
{font-family:"Arial Black";
panose-1:2 11 10 4 2 1 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-CA link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'>Hello,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'>We also had a similar issue in 2019<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'>May 2019 6768.16 GB<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'>Jun 2019 4571.42 GB<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'>Jul 2019 5033308.72 GB<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'>Aug 2019 1665015.47 GB<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'>Sep 2019 480864.23 GB<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'>Oct 2019 7492.56 GB<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'>All of the increase in traffic was China networks.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'>In my case we waited it out and still have about 50% over normal from China.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'>We were wondering what CentOS’ position on geoblocking is?<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'>Good day,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'>Didier<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'><o:p> </o:p></span></p><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>Didier Aeschimann<br>Calgah Computer Systems Ltd. / IT Security Division<br>1405 Henri-Bourassa E.<br>Montreal, Quebec, Canada H2C 1H1<br>Tel:(514) 335 0405 Fax. </span><span lang=FR-CA style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>(514) 335 6541<br>Email: nospam@redwarning.com, didier@calgah.com<br>http://www.calgah.com<br> <br><br></span><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'><o:p></o:p></span></p></div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri",sans-serif'>From:</span></b><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri",sans-serif'> CentOS-mirror <centos-mirror-bounces@centos.org> <b>On Behalf Of </b>Cihan Nimsi via CentOS-mirror<br><b>Sent:</b> October-06-20 09:23<br><b>To:</b> centos-mirror@centos.org<br><b>Subject:</b> Re: [CentOS-mirror] [Ticket#2020100504000801] Potential DOS attack against a mirror<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p>Hello,<o:p></o:p></p><p><o:p> </o:p></p><p>We also had the same problem and blocked China. Problem solved.<o:p></o:p></p><p><o:p> </o:p></p><div><p class=MsoNormal>6.10.2020 01:23 tarihinde Christopher Hawker yazdı:<o:p></o:p></p></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><div><p class=MsoNormal><span style='font-family:"Calibri",sans-serif;color:black'>Hi Thomas,<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Calibri",sans-serif;color:black'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Calibri",sans-serif;color:black'>You could simply use GeoIP Blocking to filter out any traffic from China. Here's a link to achieve this for Apache: <a href="https://www.cloudibee.com/geoip-based-country-blocking-for-apache/" id=LPlnk>https://www.cloudibee.com/geoip-based-country-blocking-for-apache/</a>.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Calibri",sans-serif;color:black'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Calibri",sans-serif;color:black'>Regards,<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Calibri",sans-serif;color:black'>Christopher Hawker<o:p></o:p></span></p></div><p class=MsoNormal><o:p> </o:p></p><div><div><p class=MsoNormal><span style='font-family:"Calibri",sans-serif;color:black'><o:p> </o:p></span></p></div><div class=MsoNormal align=center style='text-align:center'><hr size=2 width="98%" align=center></div><div id=divRplyFwdMsg><p class=MsoNormal><b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:black'>From:</span></b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:black'> CentOS-mirror <a href="mailto:centos-mirror-bounces@centos.org"><centos-mirror-bounces@centos.org></a> on behalf of Thomas Enos <a href="mailto:thomas.enos@afghan-wireless.com"><thomas.enos@afghan-wireless.com></a><br><b>Sent:</b> Tuesday, 6 October 2020 4:34 AM<br><b>To:</b> Mailing list for CentOS mirrors. <a href="mailto:centos-mirror@centos.org"><centos-mirror@centos.org></a>; CEDIA FOSS Mirrors <a href="mailto:mirror@cedia.org.ec"><mirror@cedia.org.ec></a><br><b>Subject:</b> Re: [CentOS-mirror] [Ticket#2020100504000801] Potential DOS attack against a mirror</span> <o:p></o:p></p><div><p class=MsoNormal> <o:p></o:p></p></div></div><div><div><p class=MsoNormal><span style='font-size:11.0pt'>We can confirm being hit by 27.221.66.0/24 pulling the same iso as well. What action was taken to address this by your networks?<br><br>Thanks,<br><br>From: CentOS-mirror <a href="mailto:centos-mirror-bounces@centos.org"><centos-mirror-bounces@centos.org></a> on behalf of Bogdan-Stefan Rotariu <a href="mailto:bogdan.rotariu@chroot.ro"><bogdan.rotariu@chroot.ro></a><br>Reply to: "Mailing list for CentOS mirrors." <a href="mailto:centos-mirror@centos.org"><centos-mirror@centos.org></a><br>Date: Monday, 5 October 2020 at 9:30 PM<br>To: CEDIA FOSS Mirrors <a href="mailto:mirror@cedia.org.ec"><mirror@cedia.org.ec></a>, "Mailing list for CentOS mirrors." <a href="mailto:centos-mirror@centos.org"><centos-mirror@centos.org></a><br>Subject: Re: [CentOS-mirror] [Ticket#2020100504000801] Potential DOS attack against a mirror<br><br>[EXTERNAL EMAIL] This is an external email, please make sure the sender is well known before clicking on any link or opening an attachment, if spam report it to <a href="mailto:CIRT@afghan-wireless.com">CIRT@afghan-wireless.com</a><br><br>Hi there,<br><br>On Oct 5, 2020, at 20:24, CEDIA FOSS Mirrors via CentOS-mirror <a href="mailto:centos-mirror@centos.org"><centos-mirror@centos.org></a> wrote:<br>hi<br><br><snip><br><br>112.95.214.226 - China Unicom Guangdong province network<br>223.88.61.170 - China Mobile Communications Corporation<br>171.41.7.29 - CHINANET Hubei province network<br>120.84.10.190 - China Unicom Guangdong province network<br>27.221.66.104 - China Unicom Shandong province network<br>27.221.66.105 - China Unicom Shandong province network<br>112.32.21.93 - China Mobile Communications Corporation<br>27.221.49.135 - China Unicom Shandong province network<br><br>Have you noticed that in your mirrors? look for these IP and notice if they have been trying to continously download iso<br><br>We did encounter the same issues with the same IP addresses and same iso file. Till now I thought it was an isolated issue..<br><br>—<br>Bogdan-Stefan Rotariu<br>CTO,Founder<br>Chroot Network SRL<br>WEB: <a href="http://www.chroot.ro%3chttp:/track.chroot.ro/?a=10395&m=&n=&s=12c000000d625fc&u=http%3a%2f%2fwww.chroot.ro%3futm_source%3d%26utm_medium%3demail%26utm_campaign%3dunspecified&t=&e=contact%40chroot.ro&h=8a6c74da">http://www.chroot.ro<http://track.chroot.ro/?a=10395&m=&n=&s=12c000000d625fc&u=http%3a%2f%2fwww.chroot.ro%3futm_source%3d%26utm_medium%3demail%26utm_campaign%3dunspecified&t=&e=contact%40chroot.ro&h=8a6c74da</a>><br>Phone: +40-731-247-668<a href="tel:+40-731-247-668"><tel:+40-731-247-668></a><br>Suport tehnic: <a href="mailto:suport@chroot.ro">suport@chroot.ro</a><<a href="mailto:suport@chroot.ro">mailto:suport@chroot.ro</a>><br>Suport vanzari: <a href="mailto:vanzari@chroot.ro">vanzari@chroot.ro</a><<a href="mailto:vanzari@chroot.ro">mailto:vanzari@chroot.ro</a>><br>Contact general: <a href="mailto:contact@chroot.ro">contact@chroot.ro</a><<a href="mailto:contact@chroot.ro">mailto:contact@chroot.ro</a>><br><br>_______________________________________________<br>CentOS-mirror mailing list<br><a href="mailto:CentOS-mirror@centos.org">CentOS-mirror@centos.org</a><br><a href="https://lists.centos.org/mailman/listinfo/centos-mirror">https://lists.centos.org/mailman/listinfo/centos-mirror</a><o:p></o:p></span></p></div></div></div><p class=MsoNormal><br><br><o:p></o:p></p><pre>_______________________________________________<o:p></o:p></pre><pre>CentOS-mirror mailing list<o:p></o:p></pre><pre><a href="mailto:CentOS-mirror@centos.org">CentOS-mirror@centos.org</a><o:p></o:p></pre><pre><a href="https://lists.centos.org/mailman/listinfo/centos-mirror">https://lists.centos.org/mailman/listinfo/centos-mirror</a><o:p></o:p></pre></blockquote><div><p class=MsoNormal>-- <o:p></o:p></p><table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 width=0 style='width:300.0pt'><tr><td style='padding:0cm 0cm 0cm 0cm'><p class=MsoNormal style='line-height:10.5pt'><span style='font-size:9.0pt;font-family:"Arial",sans-serif;color:#3E3E3E'>İyi Çalışmalar / Best Regards,<o:p></o:p></span></p></td></tr><tr><td style='padding:0cm 0cm 2.25pt 0cm'><p class=MsoNormal style='line-height:15.0pt'><b><span style='font-size:13.0pt;font-family:"Arial Black",sans-serif;color:#3E3E3E'>Cihan Nimsi <o:p></o:p></span></b></p></td></tr><tr><td style='padding:0cm 0cm 2.25pt 0cm'><p class=MsoNormal style='line-height:13.5pt'><span style='font-size:11.0pt;font-family:"Arial",sans-serif;color:#1793CE'>C-Level Executive<o:p></o:p></span></p></td></tr><tr><td style='padding:16.5pt 0cm 0cm 0cm'><p class=MsoNormal style='line-height:10.5pt'><span style='font-size:9.0pt;font-family:"Arial",sans-serif'><a href="https://www.guzel.net.tr" target="_blank"><span style='text-decoration:none'><img border=0 width=166 style='width:1.7291in' id="_x0000_i1026" src="https://www.guzel.net.tr/templates/guzelv3/images/logo.png" alt=Logo></span></a><o:p></o:p></span></p></td></tr><tr><td style='padding:9.0pt 0cm 0cm 0cm'><p class=MsoNormal style='line-height:10.5pt'><span style='font-size:9.0pt;font-family:"Arial",sans-serif'> <o:p></o:p></span></p></td></tr><tr><td style='padding:0cm 0cm 0cm 0cm'><p class=MsoNormal style='line-height:10.5pt'><span style='font-size:9.0pt;font-family:"Arial",sans-serif;color:#3E3E3E'>İçerenköy Mh. Ertaç Sk. Ardil İş Merkezi<o:p></o:p></span></p></td></tr><tr><td style='padding:0cm 0cm 0cm 0cm'><p class=MsoNormal style='line-height:10.5pt'><span style='font-size:9.0pt;font-family:"Arial",sans-serif;color:#3E3E3E'>No: 4/2 Kat: 1 Ataşehir/İSTANBUL<o:p></o:p></span></p></td></tr><tr><td style='padding:0cm 0cm 0cm 0cm'><p class=MsoNormal style='line-height:10.5pt'><span style='font-size:9.0pt;font-family:"Arial",sans-serif;color:#3E3E3E'>Telefon +90 850 885 0 558 - 1001<o:p></o:p></span></p></td></tr><tr><td style='padding:13.5pt 0cm 0cm 0cm'><p class=MsoNormal style='line-height:10.5pt'><b><span style='font-size:9.0pt;font-family:"Arial",sans-serif;color:#3E3E3E'><a href="https://www.guzel.net.tr" target="_blank"><span style='color:#3E3E3E;text-decoration:none'>www.guzel.net.tr</span></a> <o:p></o:p></span></b></p></td></tr><tr><td style='padding:16.5pt 0cm 0cm 0cm'><p class=MsoNormal style='line-height:10.5pt'><span style='font-size:9.0pt;font-family:"Arial",sans-serif'><a href="http://www.facebook.com/guzelhosting" target="_blank"><span style='text-decoration:none'><img border=0 width=20 height=20 style='width:.2083in;height:.2083in' id="_x0000_i1027" src="https://www.guzel.net.tr/images/custom/fb.png" alt=Facebook></span></a> <a href="http://twitter.com/guzelhosting" target="_blank"><span style='text-decoration:none'><img border=0 width=20 height=20 style='width:.2083in;height:.2083in' id="_x0000_i1028" src="https://www.guzel.net.tr/images/custom/tt.png" alt="Twitter icon"></span></a> <a href="https://www.instagram.com/guzel.hosting" target="_blank"><span style='text-decoration:none'><img border=0 width=20 height=20 style='width:.2083in;height:.2083in' id="_x0000_i1029" src="https://www.guzel.net.tr/images/custom/it.png" alt="Instagram icon"></span></a> <o:p></o:p></span></p></td></tr><tr><td style='padding:0cm 0cm 0cm 0cm'></td></tr><tr><td style='padding:12.0pt 0cm 0cm 0cm'><p class=MsoNormal style='text-align:justify;line-height:10.5pt'><span style='font-size:8.0pt;font-family:"Arial",sans-serif;color:#9B9B9B'>Bu e-mailin içeriği gizlidir ve sadece bu e-mailin alıcısına özeldir. Göndericinin izni olmadan bu mesajın 3. taraflarla paylaşılması yasaktır. Eğer bu e-mail size yanlışlıkla gönderildiyse, lütfen bu e-maili yanıtlayıp siliniz, böylece aynı hata tekrar olmayacaktır.<o:p></o:p></span></p></td></tr><tr><td style='padding:12.0pt 0cm 0cm 0cm'><p class=MsoNormal style='text-align:justify;line-height:10.5pt'><span style='font-size:8.0pt;font-family:"Arial",sans-serif;color:#9B9B9B'>The content of this email is confidential and intended for the recipient specified in message only. It is strictly forbidden to share any part of this message with any third party, without a written consent of the sender. If you received this message by mistake, please reply to this message and follow with its deletion, so that we can ensure such a mistake does not occur in the future.<o:p></o:p></span></p></td></tr></table><p class=MsoNormal><o:p> </o:p></p></div></div></body></html>