Site is being DDoS'd - Around 10 million requests an hour - What can I do?

[aidangee7]

Hi there everyone!

Hopefully this is the correct place to post (I’m completely new here!).

One of my sites has unfortunately started to be attacked by what looks like a DDoS attack originating from India.

As this is the first time this has ever happened to me, I was wondering if you could just help re-assure me that I’ve taken the necessary steps?

1. Enabled “I’m under attack”
2. Enabled “Bot Fight Mode”

It looks like 100% of these are now being blocked, please see some screenshots below:

None of the bots are able to pass through the “Managed Challenge”.

Do I now just wait out the attack and hope they stop? (It’s been going for over 24 hours so far! It started at 1 million requests an hour but has since jumped up to almost 10 million an hour).

I’ve tried looking into the the event log and with the aim of giving the Managed Challenge’s to just the bots, however, they all come from different IP addresses (IPV4 and IPV6), from different ASN’s, and different user agents, also all use GET and HTTP/3. The only thing that is the same is they all are trying to request a random 404 page (Random string of characters each time e.g. domain[dot]com/324223fjwfwehfwefwe2323423). They are 99% from India and Pakistan too, however there are a few from other countries.

Is there anyway to block there or should I just leave my site set to “I’m under attack” until it stops?

I’m on the free plan by the way.

Please let me know if you need anymore info!

Many thanks.

[jnperamo]

@aidangee7

Is there anyway to block there or should I just leave my site set to “I’m under attack” until it stops?

Mitigating an HTTP DDoS Attack manually with Cloudflare

This guide is for those users of Cloudflare who experience medium-high level complexity DDoS attacks. Continue reading if you want to accomplish the following: Becoming more familiar with the Cloudflare Dashboard and crafting custom firewall rules. Understanding the standard behavior of DDoS attacks and deploying effective firewall rules. Realizing how powerful and valuable Cloudflare Firewall Rules are. I initially thought of making a more complex guide (I will). However, I realized that no…

Understanding Under Attack Mode

Introduction Under attack mode (UAM from now on) is the first shield Cloudflare has to offer against DDoS and Bot attacks, it’s been around for nearly a decade, and even after all this time, it still holds strong against most attacks. While its performance is good, customers must understand how it works and, most importantly, its limitations and how to deal with them. The technique It makes sense that we study the big picture of what’s going on behind the scenes of this screen. …

@aidangee7

I’m on the free plan by the way.

The main problem with the free plan is that observing attack patterns is more challenging, however, the approach that is mentioned on the guides should be valid for any plan, just slightly more tedious in your case.

@aidangee7

The only thing that is the same is they all are trying to request a random 404 page (Random string of characters each time e.g. domain[dot]com/324223fjwfwehfwefwe2323423).

Those attacks are annoying, unfortunately the WAF doesn’t have any easy way to match requests that attack a random path, in your case, I’d try to look at all the other potential patterns.

Fields reference · Cloudflare Ruleset Engine docs

[aidangee7]

Thank you so much for the quick response, those are all extremely helpful!

After a bit more digging, it appears all of their user agents contain “Linux”, so I think I’m getting somewhere in being able to filter them out. I’m going to look through the guides you linked in more detail and really try to pin down a common pattern of them.

I think setting up a firewall rule for if India/Pakistan and user agent contains “Linux” will already narrow down nearly all of the bots and hopefully start to allow me to turn off “I’m under attack” for all visitors.

I hope you have a great weekend!

[aidangee7]

All of the requested spam pages end in a number, none of my legit pages do. I’m just going to create a rule, if URL path ends in 1-9, then challenge. Will monitor from there, thanks again

[eva2000]

@jnperamo

Those attacks are annoying, unfortunately the WAF doesn’t have any easy way to match requests that attack a random path, in your case, I’d try to look at all the other potential patterns.

While not perfect, you can reduce some of the attack surface area/size using Cloudflare Rate Limiting with custom 403/404 responses Unknows page request atttack - #6 by eva2000

It’s limited in a sense that rate limiting is per datacenter so with CF having 270+ locations, some requests still get through.

Here’s any example event logged entries for the above rate limiting by 403/404 rule where requests are for 404 non-existent paths on my site

[aidangee7]

Legend, thank you! Also, thanks for Centminmod (thought the name looked familiar!)

[aidangee7]

I’ve now managed to set up some rules which block all of spam and allows legitimate traffic through. Thanks everyone, marking this as solved

[eva2000]

Cheers. Glad I could help and thanks for the kind words for Centmin Mod

[jnperamo]

The problem with this is that it’s enterprise + advanced security suite only, as far as I know other plans can’t count anything other than IPs

[eva2000]

It’s Business or higher plan feature