How can i migrate endless probe from Kazakhstan which generate unnecessary traffic, thus slowing down my sites ( https://rfq.efc.asia ) , increasing my VPS CPU spikes and generating DDOS effect (after installation and removal of a wordpress plugin). I have created the firewall rules which the log show every 5 to 10 minutes block and it keep probing non-stop. What can i do next since i am using FREE Cloudflare plan? Any recommendation.
The reason is that it fill up almost all my firewall log and i am not too sure if they has bypass Cloudflare. My traffic will spike easy with an increase of my web traffic from my visitors including adhoc web attacks from bots / attackers. Please advise if there is any solution from it.
If your firewall events logs are filled with visits from Kazakhstan, it means Cloudflare is doing its job, following your Firewall Rule instruction to block them. Nothing to worry about. The internet is an open space, there’s nothing you can do if a bot (or a hundred bots) decides to probe your domain every 10 or 5 minutes, or even every other second. All you can do is block them, something apparently Cloudflare is being successful at.
What you could do is check your origin server access logs to see if any other attack patterns can be found. Perhaps repeated visits from another country, perhaps from a group of IP addresses or some user agents, then adjust your rules accordingly.
I do understand your points. Actually i have three layers of firewall. The first layer will be Cloudflare, followby my wordpress plugin firewall ,wordfence and lastly my VPS modsecurity rules. In my WHM panel using cPHulk Brute Force Protection i have even block by countries.
A handful of times, my Cloudflare firewall event log cannot even load it up or become empty. What i am looking at creating a blackhole Cloudflare rules for that specific IP address. but i do not know how. Please advise.
in term of firewall for IPtables for block and drop are difference . Is there a way to drop it in Cloudflare rules as well?
What i am looking is a simple drop / blackhole rules from Cloudflare which make it very easy for me rather than dig into my WHM to create iptables rules for that specific ip address to drop or blackhole it.
As for the firewall event using API in which i do not how to start with it.
Currently i am using APP from logflare to track my visitor then to google search console report for my visitors report only.
