Hi all,
First of all, sorry if this is the wrong mailing list for this, feel free to point me to a more appropriate place.
Some time ago, I was looking at the httpd logs of our mirror servers and I noticed a weird pattern: we seem to have an awful lot of suspicious-looking partial content requests for ISO images. In the past 24 hours, we've had 64k requests for 98 different ISOs coming from 508 different IPs.
A single IP address has sent 3115 partial content requests for CentOS-7.0-1406-x86_64-DVD.iso, and then moved on to requesting CentOS-5.11-i386-bin-DVD-1of2.iso 2069 times (in the last 24 hours). Downloading the full file doesn't seem to be the goal of this traffic, in most cases the clients download fewer bytes than the total filesize. To test this, I disabled partial requests on the server side so the full file would be served regardless of how many bytes a client requested, and the clients would carry on sending requesting even though they had already downloaded the entire file multiple times.
The requests seem to all have random-ish useragents, but all of them start with "Mozilla/5.0", so they're pretending to be web browsers. The web browsers I've tested don't issue HTTP 206 requests when downloading files, even big ones, and they would probably stop when they had the full file anyway. The vast majority of these strange requests, 95%, seem to come from Chinese IPs. We get requests all the time, but they seem to pick up around 3am CEST and they start to be less frequent by 5pm, which sort-of matches Chinese daytime.
Globally, these requests don't seem to be doing any harm, they are less than 1.2% of the requests we got in the last 24 hours, but they don't look like legitimate traffic and I just can't figure out what the point of it would be. Are we being used for weird speedtests from China? Or is this a really lazy DDoS attack?
Does anybody else see this kind of traffic? Try looking for `http_status=206 useragent="Mozilla *" uri_path="*.iso"` in your logs, I'm curious to see if this is common or not.
Cheers, Alex
Hi!
This is an old problem.
Solution:
https://lists.centos.org/pipermail/centos-mirror/2020-October/024445.html
Cheers,
Peter
2021. 07. 08. 19:38 keltezéssel, Alex Iribarren írta:
Hi all,
First of all, sorry if this is the wrong mailing list for this, feel free to point me to a more appropriate place.
Some time ago, I was looking at the httpd logs of our mirror servers and I noticed a weird pattern: we seem to have an awful lot of suspicious-looking partial content requests for ISO images. In the past 24 hours, we've had 64k requests for 98 different ISOs coming from 508 different IPs.
A single IP address has sent 3115 partial content requests for CentOS-7.0-1406-x86_64-DVD.iso, and then moved on to requesting CentOS-5.11-i386-bin-DVD-1of2.iso 2069 times (in the last 24 hours). Downloading the full file doesn't seem to be the goal of this traffic, in most cases the clients download fewer bytes than the total filesize. To test this, I disabled partial requests on the server side so the full file would be served regardless of how many bytes a client requested, and the clients would carry on sending requesting even though they had already downloaded the entire file multiple times.
The requests seem to all have random-ish useragents, but all of them start with "Mozilla/5.0", so they're pretending to be web browsers. The web browsers I've tested don't issue HTTP 206 requests when downloading files, even big ones, and they would probably stop when they had the full file anyway. The vast majority of these strange requests, 95%, seem to come from Chinese IPs. We get requests all the time, but they seem to pick up around 3am CEST and they start to be less frequent by 5pm, which sort-of matches Chinese daytime.
Globally, these requests don't seem to be doing any harm, they are less than 1.2% of the requests we got in the last 24 hours, but they don't look like legitimate traffic and I just can't figure out what the point of it would be. Are we being used for weird speedtests from China? Or is this a really lazy DDoS attack?
Does anybody else see this kind of traffic? Try looking for `http_status=206 useragent="Mozilla *" uri_path="*.iso"` in your logs, I'm curious to see if this is common or not.
Cheers, Alex _______________________________________________ CentOS-mirror mailing list CentOS-mirror@centos.org https://lists.centos.org/mailman/listinfo/centos-mirror
Hi Peter,
Thanks for pointing this out. I solved it less aggressively, and also those user agents are not the ones that I'm seeing. I'm simply ignoring the requests with Apache's ModSecurity.
In any case, I'm still wondering what they're trying to do with these requests. If anyone has any ideas, I'd love to hear them.
Cheers, Alex
On 7/8/21 8:11 PM, Quantum Mirror wrote:
Hi!
This is an old problem.
Solution:
https://lists.centos.org/pipermail/centos-mirror/2020-October/024445.html
Cheers,
Peter
- 19:38 keltezéssel, Alex Iribarren írta:
Hi all,
First of all, sorry if this is the wrong mailing list for this, feel free to point me to a more appropriate place.
Some time ago, I was looking at the httpd logs of our mirror servers and I noticed a weird pattern: we seem to have an awful lot of suspicious-looking partial content requests for ISO images. In the past 24 hours, we've had 64k requests for 98 different ISOs coming from 508 different IPs.
A single IP address has sent 3115 partial content requests for CentOS-7.0-1406-x86_64-DVD.iso, and then moved on to requesting CentOS-5.11-i386-bin-DVD-1of2.iso 2069 times (in the last 24 hours). Downloading the full file doesn't seem to be the goal of this traffic, in most cases the clients download fewer bytes than the total filesize. To test this, I disabled partial requests on the server side so the full file would be served regardless of how many bytes a client requested, and the clients would carry on sending requesting even though they had already downloaded the entire file multiple times.
The requests seem to all have random-ish useragents, but all of them start with "Mozilla/5.0", so they're pretending to be web browsers. The web browsers I've tested don't issue HTTP 206 requests when downloading files, even big ones, and they would probably stop when they had the full file anyway. The vast majority of these strange requests, 95%, seem to come from Chinese IPs. We get requests all the time, but they seem to pick up around 3am CEST and they start to be less frequent by 5pm, which sort-of matches Chinese daytime.
Globally, these requests don't seem to be doing any harm, they are less than 1.2% of the requests we got in the last 24 hours, but they don't look like legitimate traffic and I just can't figure out what the point of it would be. Are we being used for weird speedtests from China? Or is this a really lazy DDoS attack?
Does anybody else see this kind of traffic? Try looking for `http_status=206 useragent="Mozilla *" uri_path="*.iso"` in your logs, I'm curious to see if this is common or not.
Cheers, Alex _______________________________________________ CentOS-mirror mailing list CentOS-mirror@centos.org https://lists.centos.org/mailman/listinfo/centos-mirror
CentOS-mirror mailing list CentOS-mirror@centos.org https://lists.centos.org/mailman/listinfo/centos-mirror
-
Alex Iribarren -
Quantum Mirror