[arch-mirrors] Huge traffic from China

[Johannes Findeisen]

On Thu, 2 Jul 2020 07:52:26 +0200
services via arch-mirrors wrote:

> Hello,
> 
> Same case here.
> 
> Impact is low here (via one ip only), because a file which don't exist 
> (old iso) :
> arch//iso/2020.03.01/archlinux-2020.03.01-x86_64.iso" failed (2: No such 
> file or directory)
> 
> Can you share ip on the list for compare and block all ip before ddos ?

Okay, this is from the past but is from an logfile older then about 3
month:

a lighttpd # grep iso arch.unixpeople.org.access.log | awk '{ print $1
}' | sort -n | uniq -c | sort -nr | head -n 25 
   1572 194.147.110.21
   1220 95.217.42.120
    553 51.6.209.241
    401 212.129.50.243
    342 147.75.65.86
    341 27.221.66.142
    340 86.58.83.97
    323 27.221.66.141
    323 27.221.66.131
    316 27.221.66.144
    315 27.221.66.133
    309 27.221.66.143
    306 27.221.66.134
    304 27.221.66.132
    290 27.221.49.135
    282 27.221.66.139
    282 27.221.66.138
    280 27.221.66.137
    280 27.221.66.136
    276 27.221.66.152
    267 27.221.66.146
    265 27.221.66.148
    263 27.221.66.147
    241 216.244.66.201
    238 27.221.66.154

It this is just the top 25!

The list with more then 100 downloads is very long... :|

Regards
Johannes