DDos my site even with CF "I'm under attack mode"

[or11]

Hi,

I have a site which is constantly attacked, mainly by DDos.
Recent attacks succeed in taking my apache server down, even when setting Cloudflare’s “I’m under attack mode” to true.
I see A LOT of requests in httpd/access_log which have the referer of Cloudflare javascript challenge… Does that mean they found a way to overcome Cloudflare security?
Below is an example of one of the thousands of requests I’m receiving:
Does anyone know how this can be solved?

• 172.69.226.113 - - [21/Apr/2019:14:37:39 +0300] “GET /Lottery/ HTTP/1.1” 200 1557 “https://www.XXXXXX.com/cdn-cgi/l/chk_jschl?s=a593af14564ab33e3e57c200f71625fa812c0565-1555846629-1800-ASfenqY5ezVTGWokp9nHFvpfzIi3Oik8PqgJeTsvA66Ogb1TFIylyDQYO7je8UIR0xSQOh1dJw3C0STG6jiVOAkFFdSwgWsXqOUnu5QTs5rN4q2LXj2%2F06%2FfMYGC8pGCXw%3D%3D&jschl_vc=ab2510d496e0949d5b895b1bdbd4b6ba&pass=1555846633.816-5mijUpQBwg&jschl_answer=30.7158909856” “Mozilla/5.0 (X11; U; FreeBSD i386; de-CH; rv:1.9.2.8) Gecko/20100729 Firefox/3.6.8”

[Xaq]

You can use rate limiting for such an attack.

[Withheld]

Also, when hiding your site behind Cloudflare proxy, all traffic will appear to be from Cloudflare.

[or11]

Thanks for the answer. Did that just now, though it might catch some legit users (as it’s a fast chatting site).
For me it would be best to present ALL users with a capcha on their first time coming to the site (or every hour or so), is it possible to do it in Cloudflare?

Thanks!

[Xaq]

Now you have enabled rate-limiting you can set the Security Level for your domain to High in the Settings tab of the Firewall and see how it works for you.

[or11]

Hi, the Security Level for my domain has been in “I’m under attack” mode for the last day, and the server keeps going down (even though I have enabled rate-limiting).
Is there a way to force a captcha to appear for EVERY user? I think it would be best.

[cbrandt]

You can create a Firewall Rule that will impose a Captcha to everyone. Ideally, you should exclude “good bots” to avoid SEO penalties (I’m Under Attack will do it automatically, but if you create a Firewall Rule, you must be explicit about it.)

You can always replace the string I created with some other random string. You can tinker with this rule. After you’ve enabled it, you will see under Firewall > Events more details about who’s promoting this attack. Then you may create a more refined rule. For instance, if most attacking bots come from, say, Germany and China, you may restrict the Captcha to visitors from these countries. Or you can create specific rules for User Agents and IP addresses.

Also, you should go to Firewall > Settings and set a generous time for the time it will take for a Captcha to be shown again for your legit users, otherwise they may just give up on your website.EDIT: Also, if you enable this rule, don’t forget to turn off I’m Under Attack Mode. Your visitors will appreciate it.

[or11]

Thank you so much, You helped me a lot!!