<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
Wasn't it fixed by blockeing specific user agent? <br>
<br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
#Bad User agents<br>
<br>
</div>
<div align="left">
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
map $http_user_agent $isbadbrowser {<br>
</div>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
<br>
</div>
<div align="left">
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
default 0;<br>
</div>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
<br>
</div>
<div align="left">
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
"~*Mozilla/5\.0 \(Linux; Android\)" 1;<br>
</div>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
<br>
</div>
<div align="left">
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
"~*Chrome/49\.0\.2623\.87" 1;<br>
</div>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
<br>
</div>
<div align="left">
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
"~*Firefox/3.6.3" 1;<br>
</div>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
<br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
}<br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
<span id="OutlookSignature"></span><br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
<b><font color="#000000">From:</font></b><font color="#000000"> CentOS-mirror <centos-mirror-bounces@centos.org> on behalf of Paul Mezzanini <paul@themezz.com></font><br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
<b><font color="#000000">Sent:</font></b><font color="#000000"> Wednesday, April 27, 2022 11:55:50 AM</font><br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
<b><font color="#000000">To:</font></b><font color="#000000"> Mailing list for CentOS mirrors. <centos-mirror@centos.org></font><br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
<b><font color="#000000">Subject:</font></b><font color="#000000"> Re: [CentOS-mirror] Chinese addresses requesting excessive iso's?</font>
<br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
<br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
We've been noticing the exact same behaviour and are still discussing internally the best way to address it.
<br>
<br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
On Wed, Apr 27, 2022 at 2:28 PM Stephen Smoogen < <a href="mailto:ssmoogen@redhat.com">
ssmoogen@redhat.com</a>> wrote: <br>
</div>
<blockquote type="cite">
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
<br>
<br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
On Wed, 27 Apr 2022 at 14:16, Russell Jones < <a href="mailto:arjones85@gmail.com">
arjones85@gmail.com</a>> wrote: <br>
</div>
</blockquote>
<blockquote type="cite">
<blockquote type="cite">
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
So, for whatever reason my mirror seems to be getting targeted by China: <br>
<br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
<tt>[root@repos ~]# tail -f access.log | grep 403</tt><br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
<tt>112.22.135.89 - - [27/Apr/2022:13:10:52 -0500] "GET /centos/7.9.2009/isos/x86_64/CentOS-7-x86_64-Everything-2009.iso HTTP/1.1" 403 153 "-" "curl/7.29.0"</tt><br>
</div>
</blockquote>
</blockquote>
<blockquote type="cite">
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
<br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
<deleted> <br>
</div>
</blockquote>
<blockquote type="cite">
<blockquote type="cite">
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
I geoblocked the country about a week ago, but the requests haven't stopped. It was at the level that it was maxing out my 1gbit/sec link until I did something.
<br>
<br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
Anyone else seeing anything similar? <br>
</div>
</blockquote>
</blockquote>
<blockquote type="cite">
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
<br>
<br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
I have seen this going for about 10 years with different mirrors. The connections are one of three things:
<br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
1. Automated downloaders getting blocked by Great-Firewall configurations getting to a certain point
<br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
2. Malware installed on a lot of systems being commanded to download the software and desist. This is usually done to cause bandwidth issues all through the stack. They are either getting stopped by firewalls or just stopping the connections themselves as part
of the badness. <br>
<br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
>From mirror managing Fedora, number 2 seems to be more likely as a lot of the IP addresses doing this never show up on asking mirrormanager for downloads. Instead they seem to have gotten a list of mirrors from some third party and are being commanded to do
the infinite downloads. I don't know if this is similar with what is going on now.
<br>
<br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
<br>
</div>
</blockquote>
<blockquote type="cite">
<blockquote type="cite">
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
<br>
<br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
_______________________________________________ <br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
CentOS-mirror mailing list <br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
<a href="mailto:CentOS-mirror@centos.org">CentOS-mirror@centos.org</a> <br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
<a href="https://lists.centos.org/mailman/listinfo/centos-mirror">https://lists.centos.org/mailman/listinfo/centos-mirror</a>
<br>
</div>
</blockquote>
</blockquote>
<blockquote type="cite">
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
<br>
<br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
-- <br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
Stephen Smoogen, Red Hat Automotive <br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
Let us be kind to one another, for most of us are fighting a hard battle. -- Ian MacClaren
<br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
_______________________________________________ <br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
CentOS-mirror mailing list <br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
<a href="mailto:CentOS-mirror@centos.org">CentOS-mirror@centos.org</a> <br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
<a href="https://lists.centos.org/mailman/listinfo/centos-mirror">https://lists.centos.org/mailman/listinfo/centos-mirror</a>
<br>
</div>
</blockquote>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> CentOS-mirror <centos-mirror-bounces@centos.org> on behalf of Paul Mezzanini <paul@themezz.com><br>
<b>Sent:</b> Wednesday, April 27, 2022 11:55:50 AM<br>
<b>To:</b> Mailing list for CentOS mirrors. <centos-mirror@centos.org><br>
<b>Subject:</b> Re: [CentOS-mirror] Chinese addresses requesting excessive iso's?</font>
<div> </div>
</div>
<div>
<div dir="ltr">We've been noticing the exact same behaviour and are still discussing internally the best way to address it.</div>
<br>
<div class="x_gmail_quote">
<div dir="ltr" class="x_gmail_attr">On Wed, Apr 27, 2022 at 2:28 PM Stephen Smoogen <<a href="mailto:ssmoogen@redhat.com">ssmoogen@redhat.com</a>> wrote:<br>
</div>
<blockquote class="x_gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
<div dir="ltr">
<div dir="ltr"><br>
</div>
<br>
<div class="x_gmail_quote">
<div dir="ltr" class="x_gmail_attr">On Wed, 27 Apr 2022 at 14:16, Russell Jones <<a href="mailto:arjones85@gmail.com" target="_blank">arjones85@gmail.com</a>> wrote:<br>
</div>
<blockquote class="x_gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
<div dir="ltr">
<div>So, for whatever reason my mirror seems to be getting targeted by China:</div>
<div><br>
</div>
<div><font face="monospace">[root@repos ~]# tail -f access.log | grep 403<br>
112.22.135.89 - - [27/Apr/2022:13:10:52 -0500] "GET /centos/7.9.2009/isos/x86_64/CentOS-7-x86_64-Everything-2009.iso HTTP/1.1" 403 153 "-" "curl/7.29.0"<br>
</font></div>
</div>
</blockquote>
<div><br>
</div>
<div><deleted> </div>
<blockquote class="x_gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
<div dir="ltr">
<div><font face="monospace"></font></div>
<div><font face="arial, sans-serif">I geoblocked the country about a week ago, but the requests haven't stopped. It was at the level that it was maxing out my 1gbit/sec link until I did something.</font></div>
<div><font face="arial, sans-serif"><br>
</font></div>
<div><font face="arial, sans-serif">Anyone else seeing anything similar?</font></div>
<div><font face="arial, sans-serif"><br>
</font></div>
</div>
</blockquote>
<div><br>
</div>
<div>I have seen this going for about 10 years with different mirrors. The connections are one of three things:</div>
<div>1. Automated downloaders getting blocked by Great-Firewall configurations getting to a certain point</div>
<div>2. Malware installed on a lot of systems being commanded to download the software and desist. This is usually done to cause bandwidth issues all through the stack. They are either getting stopped by firewalls or just stopping the connections themselves
as part of the badness.</div>
<div><br>
</div>
<div>From mirror managing Fedora, number 2 seems to be more likely as a lot of the IP addresses doing this never show up on asking mirrormanager for downloads. Instead they seem to have gotten a list of mirrors from some third party and are being commanded
to do the infinite downloads. I don't know if this is similar with what is going on now. </div>
<div><br>
</div>
<div> </div>
<blockquote class="x_gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
<div dir="ltr">
<div><font face="arial, sans-serif"></font></div>
<div><font face="arial, sans-serif"><br>
</font></div>
<div><font face="arial, sans-serif"><br>
</font></div>
</div>
_______________________________________________<br>
CentOS-mirror mailing list<br>
<a href="mailto:CentOS-mirror@centos.org" target="_blank">CentOS-mirror@centos.org</a><br>
<a href="https://lists.centos.org/mailman/listinfo/centos-mirror" rel="noreferrer" target="_blank">https://lists.centos.org/mailman/listinfo/centos-mirror</a><br>
</blockquote>
</div>
<br clear="all">
<div><br>
</div>
-- <br>
<div dir="ltr">
<div dir="ltr">
<div>
<div></div>
Stephen Smoogen, Red Hat Automotive<br>
</div>
Let us be kind to one another, for most of us are fighting a hard battle. -- Ian MacClaren<br>
</div>
</div>
</div>
_______________________________________________<br>
CentOS-mirror mailing list<br>
<a href="mailto:CentOS-mirror@centos.org" target="_blank">CentOS-mirror@centos.org</a><br>
<a href="https://lists.centos.org/mailman/listinfo/centos-mirror" rel="noreferrer" target="_blank">https://lists.centos.org/mailman/listinfo/centos-mirror</a><br>
</blockquote>
</div>
</div>
</body>
</html>