SIf you are under a DDoS attack then you can take a look at these threads for first steps and help with mitigation:
XThese posts are a little outdated and I can't seem to find the things they're refrencing.
XI really don't know. I'm new to this.
XCould you explain what that means? I mean, I see something that says "25.77M Total," what does "served by origin mean?"
XAre they really all being blocked?
Iyour origin is whatever server you're running
Ithis means out of the > 25 million requests, only 63 actually made it to your server
XWow!
XMakes me a lot less worried... But still, I'm scared. My server still isn't functioning well even after only being hit by 105. What steps should I take moving forward?
Icheck your server if it's actually only receiving 105 requests. If the attacker got hold of your origins IP then they can completely circumvent cloudflare (...)
if however your origin indeed only received 105 requests and is still struggling then i have to say this seems more like a server issue than a ddos issue
if however your origin indeed only received 105 requests and is still struggling then i have to say this seems more like a server issue than a ddos issue
XI see. How does the attacker affect my server? Are they requesting information? Do you know how I can check, and limit that amount of data thats being requested?
I:gophercrying:
Iyou are the only person who can answer those questions
Ii know nothing about your infrastructure and the traffic you usually work with
XWell one thing I'm wondering now, is what I can do to get my server running again. I can't access it anymore, it keeps saying that I've been "redirected too many times." Any tips?
XWhat do I do about the ones that did get served by the origin?
NCheck the logs, this could be legitimate traffic reaching your domain during the attack.
XI did. Quite a few were bots. I can’t access my site even though no new ones are making it through; what now?
N"I can’t access my site" - Is your site down due to the attack?
Can you please take a screenshot of the security events for me?
If it is a DDOS attack then CF automatically activates the DDOS protection ruleset
Can you please take a screenshot of the security events for me?
If it is a DDOS attack then CF automatically activates the DDOS protection ruleset
XThis is what I see when going to the site.
X
NI would recommend you to create a rate limit rule.
I don't know what amount of requests is considered normal for your domain but for example:
Create a rule that blocks any IP address that tries to send you more than 700 requests in 10 seconds.
I don't know what amount of requests is considered normal for your domain but for example:
Create a rule that blocks any IP address that tries to send you more than 700 requests in 10 seconds.
NAdditionally, I would consider blocking "definitely automated" bots through the super bot fight mode.
1DNS over Discord: WHOIS
MHmm
