<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Same here. We also blocked the addresses listed below. They were constantly downloading full ISOs to the same images causing a consistent > 5 Gbps stream.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Kevin<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">CentOS-mirror <centos-mirror-bounces@centos.org> on behalf of Awesome Projects via CentOS-mirror <centos-mirror@centos.org><br>
<b>Reply-To: </b>Awesome Projects <mirrors@awesomeprojects.ro>, "Mailing list for CentOS mirrors." <centos-mirror@centos.org><br>
<b>Date: </b>Thursday, October 26, 2023 at 9:43 AM<br>
<b>To: </b>"centos-mirror@centos.org" <centos-mirror@centos.org><br>
<b>Subject: </b>Re: [CentOS-mirror] CentOS-mirror Digest, Vol 221, Issue 2<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"> Hello,<br>
<br>
we experienced the same thing from the same IP's about 6 months ago. <br>
This happened simultaneously with some IPv6 classes. Can't supply the <br>
IP's however, we blocked all the netblocks we could identify as <br>
belonging to China.<br>
<br>
On 10/26/23 15:00, centos-mirror-request@centos.org wrote:<br>
> Send CentOS-mirror mailing list submissions to<br>
> centos-mirror@centos.org<br>
><br>
> To subscribe or unsubscribe via the World Wide Web, visit<br>
> <a href="https://lists.centos.org/mailman/listinfo/centos-mirror">
https://lists.centos.org/mailman/listinfo/centos-mirror</a><br>
> or, via email, send a message with subject or body 'help' to<br>
> centos-mirror-request@centos.org<br>
><br>
> You can reach the person managing the list at<br>
> centos-mirror-owner@centos.org<br>
><br>
> When replying, please edit your Subject line so it is more specific<br>
> than "Re: Contents of CentOS-mirror digest..."<br>
><br>
><br>
> Today's Topics:<br>
><br>
> 1. Re: DDoS attack (Dominik Nowacki)<br>
><br>
><br>
> ----------------------------------------------------------------------<br>
><br>
> Message: 1<br>
> Date: Wed, 25 Oct 2023 12:14:55 +0000<br>
> From: Dominik Nowacki <dominik@clouvider.co.uk><br>
> To: Mailing list for CentOS mirrors. <centos-mirror@centos.org><br>
> Subject: Re: [CentOS-mirror] DDoS attack<br>
> Message-ID: <1CE1A3D7-BD4F-4BED-85BB-8AF3707C2E29@clouvider.co.uk><br>
> Content-Type: text/plain; charset="utf-8"<br>
><br>
> And same here.<br>
> One of our mirror servers was impacted.<br>
><br>
> Kind Regards,<br>
> D<br>
><br>
> Sent from my iPhone<br>
><br>
>> On 25 Oct 2023, at 12:40, ariel sabiguero yawelak <asabigue@fder.edu.uy> wrote:<br>
>><br>
>> ?We had to implement equivalent filtering rules during the weekend from network
<a href="http://223.67.0.0/16">
223.67.0.0/16</a>... and after your experience, we will start blocking <a href="http://182.255.33.0/24">
182.255.33.0/24</a> too.<br>
>><br>
>> regards<br>
>><br>
>><br>
>> ariel<br>
>><br>
>>> On 25/10/23 8:24, Alex Iribarren wrote:<br>
>>> Hi all,<br>
>>><br>
>>> This morning we stopped a DDoS attack on our mirror coming from China. The traffic was somewhat similar to what we've discussed in the past[1], except this time they weren't range requests, they were downloading the full iso files. The worst offenders were
<a href="http://223.67.0.0/16">
223.67.0.0/16</a> and <a href="http://182.255.33.0/24">
182.255.33.0/24</a>, in case you want to check your mirrors for signs of abuse.<br>
>>><br>
>>> Cheers,<br>
>>> Alex<br>
>>><br>
>>><br>
>>> [1] <a href="https://lists.centos.org/pipermail/centos-mirror/2022-April/077440.html">
https://lists.centos.org/pipermail/centos-mirror/2022-April/077440.html</a><br>
>>> _______________________________________________<br>
>>> CentOS-mirror mailing list<br>
>>> CentOS-mirror@centos.org<br>
>>> <a href="https://lists.centos.org/mailman/listinfo/centos-mirror">
https://lists.centos.org/mailman/listinfo/centos-mirror</a><br>
>> _______________________________________________<br>
>> CentOS-mirror mailing list<br>
>> CentOS-mirror@centos.org<br>
>> <a href="https://lists.centos.org/mailman/listinfo/centos-mirror">
https://lists.centos.org/mailman/listinfo/centos-mirror</a><br>
> ------------------------------<br>
><br>
> Subject: Digest Footer<br>
><br>
> _______________________________________________<br>
> CentOS-mirror mailing list<br>
> CentOS-mirror@centos.org<br>
> <a href="https://lists.centos.org/mailman/listinfo/centos-mirror">
https://lists.centos.org/mailman/listinfo/centos-mirror</a><br>
><br>
><br>
> ------------------------------<br>
><br>
> End of CentOS-mirror Digest, Vol 221, Issue 2<br>
> *********************************************<br>
_______________________________________________<br>
CentOS-mirror mailing list<br>
CentOS-mirror@centos.org<br>
<a href="https://lists.centos.org/mailman/listinfo/centos-mirror">https://lists.centos.org/mailman/listinfo/centos-mirror</a><br>
<br>
<o:p></o:p></p>
</div>
</body>
</html>