DDOS from Cloudflare IP addresses even in Under Attack Mode

Website, Application, Performance Security
1

Hello, for the last three days I am being DDOS’d periodically with a huge amount of traffic (up to 100gb per hour). Initially Sloudflare, helped, but today I found that my apache server went down.

My settings are as follows:

  1. Root (/) page is always in under attack mode
  2. Firewall is creating JS Chalenge for every user not from 6 particular countries.

In server logs I see tens of thousands of requests per second from Sloudflare ip addresses, how did they get through JS Chalenge and why weren’t they stopped?

Screenshot_5
Screenshot_51063×663 19.4 KB

2

Screenshot_8
Screenshot_81920×1198 103 KB

3

You’ll need to be restoring the actual visitor IP addresses to be able to make any meaningful decisions based on access logs.

https://support.cloudflare.com/hc/en-us/articles/200170786-Restoring-original-visitor-IPs

2 Likes
4

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.