What firewall rule should I create?

[newbie110]

Hi, everyone. The IP in the screenshot visited my site so frequently. Does this mean it is a spam bot?

If I block this IP, it will use another IP to attack my site. So what firewall rule should I create? Is it better to create managed challenge for AS4771?

Thanks!

[erictung]

Did you find any other patterns e.g. the user agent and the URLs they hit your site? If no, send managed challenge to the entire AS4771 should be sufficient.

[newbie110]

@erictung

Did you find any other patterns e.g. the user agent and the URLs they hit your site?

Thank you very much. Here is the pattern.

I will first block the ip in firewall->tools. What should I do next in terms of firewall rule?

[erictung]

Looks like it’s Apple mobile app traffic. Doesn’t look like spam.

If you still want to challenge them, you can combine both ASN and user agent while creating a firewall rule.

[newbie110]

@erictung

Looks like it’s Apple mobile app traffic. Doesn’t look like spam.

Thank you. So, it is actually very normal to see frequent requests from the same IP address in such a short period of time as you can see in Post 1?

[erictung]

It’s common to see a user make tens or hundreds of requests within seconds (depending on how many resources are needed to load a webpage).

But if you are talking about the user making tons of requests for a few hours or maybe days, then something’s not right.

[newbie110]

@erictung

It’s common to see a user make tens or hundreds of requests within seconds (depending on how many resources are needed to load a webpage).

Thank you very much. Then how I can identify spam traffic in Firewall Events? I don’t want to have managed change for all traffic forever.

[erictung]

You can refer to some of the topics here:

Mitigating an HTTP DDoS Attack manually with Cloudflare

This guide is for those users of Cloudflare who experience medium-high level complexity DDoS attacks. Continue reading if you want to accomplish the following: Becoming more familiar with the Cloudflare Dashboard and crafting custom firewall rules. Understanding the standard behavior of DDoS attacks and deploying effective firewall rules. Realizing how powerful and valuable Cloudflare Firewall Rules are. I initially thought of making a more complex guide (I will). However, I realized that no…

Understanding Under Attack Mode

Introduction Under attack mode (UAM from now on) is the first shield Cloudflare has to offer against DDoS and Bot attacks, it’s been around for nearly a decade, and even after all this time, it still holds strong against most attacks. While its performance is good, customers must understand how it works and, most importantly, its limitations and how to deal with them. The technique It makes sense that we study the big picture of what’s going on behind the scenes of this screen. …

[newbie110]

Thank you very much. I learned a lot.