10 million requests in 5 minutes, cloudflare can't protect me

[bitkalolka]

My site was attacked and in less than 5 hours, there were about 112 million requests. The person organizing this DDoS attack is extorting money…

what I can do?

[albert]

Please take a look at the following Community Tutorial:

Mitigating an HTTP DDoS Attack manually with Cloudflare

This guide is for those users of Cloudflare who experience medium-high level complexity DDoS attacks. Continue reading if you want to accomplish the following: Becoming more familiar with the Cloudflare Dashboard and crafting custom firewall rules. Understanding the standard behavior of DDoS attacks and deploying effective firewall rules. Realizing how powerful and valuable Cloudflare Firewall Rules are. I initially thought of making a more complex guide (I will). However, I realized that no…

[cos]

You need to take those IPs and scan for ASN and block those they’d be belonging to a malicious network.

Beyond that, it only takes about 3-6K unique IPs hitting your site at once to bring a single core to a complete stop, so in this case the attack wasn’t large you weren’t filtering it correctly that’s all.

Try adjusting your firewall and turning up the sensitivity of your security. Also don’t worry, you’re probably stressed out, this can be stopped easily!