Return of Gigantic surge of bots despite DDOS mode

[spmbx]

What is the name of the domain?

exammmmmple.com

What is the issue you’re encountering

Gigantic surge of bots despite DDOS mode

What steps have you taken to resolve the issue?

botnets are back, bypassing cloudflare DDOS mode
I know this traffic surge is illegitimate because google adsense doesn’t see any traffic increase

What I have tired :
I have enabled ddos mode nonstop
I have enabled rate limit 10 hit per 10 sec
I have enabled “Bot Fight Mode” and “Block AI Bots” and “AI Labyrinth”
I have a block list of known hosting ASN in WAF
I have enabled captcha for known bots except my allowlist in WAF (cf.client.bot and not ip.src.asnum in {***})
I have blocked known threats in WAF (cf.threat_score gt 0)

Screenshot of the error

[cscharff]

Visitors doesn’t mean the request was successful. In your firewall are the requests being blocked that match your rules?

cf.threat_score is always 0 I believe so the last rule probably doesn’t have any hits.

Security Level · Cloudflare Web Application Firewall (WAF) docs

[spmbx]

I should have mentionned it above but traffic was 30X the regular traffic so yes at least a signifant part of that bot traffic surge did hit the site