I'm getting DDOSed. | Cloudflare Developers | Page 1

glad fern Jan 23, 2025, 10:13 AM

#

?ddos

dreamy glacierBOT Jan 23, 2025, 10:13 AM

#

If you are under a DDoS attack then you can take a look at these threads for first steps and help with mitigation:

glad fern Jan 23, 2025, 10:13 AM

#

but they're already being mitigated?

#

not sure what kind of "ideas" you want

grand quest Jan 23, 2025, 10:21 AM

#

These posts are a little outdated and I can't seem to find the things they're refrencing.

glad fern Jan 23, 2025, 10:22 AM

#

and what kind of ideas do you want

grand quest Jan 23, 2025, 10:22 AM

#

I really don't know. I'm new to this.

glad fern Jan 23, 2025, 10:22 AM

#

it's all being blocked

#

you don't need to do anything

grand quest Jan 23, 2025, 10:23 AM

#

Could you explain what that means? I mean, I see something that says "25.77M Total," what does "served by origin mean?"

#

Are they really all being blocked?

paper meteor Jan 23, 2025, 10:24 AM

#

your origin is whatever server you're running

#

this means out of the > 25 million requests, only 63 actually made it to your server

grand quest Jan 23, 2025, 10:24 AM

#

Wow!

#

Makes me a lot less worried... But still, I'm scared. My server still isn't functioning well even after only being hit by 105. What steps should I take moving forward?

paper meteor Jan 23, 2025, 10:26 AM

#

check your server if it's actually only receiving 105 requests. If the attacker got hold of your origins IP then they can completely circumvent cloudflare (...)

if however your origin indeed only received 105 requests and is still struggling then i have to say this seems more like a server issue than a ddos issue

grand quest Jan 23, 2025, 10:27 AM

#

I see. How does the attacker affect my server? Are they requesting information? Do you know how I can check, and limit that amount of data thats being requested?

paper meteor Jan 23, 2025, 10:29 AM

#

gophercrying

#

you are the only person who can answer those questions

#

i know nothing about your infrastructure and the traffic you usually work with

grand quest Jan 23, 2025, 10:43 AM

#

paper meteor <:gophercrying:783721529426051083>

Well one thing I'm wondering now, is what I can do to get my server running again. I can't access it anymore, it keeps saying that I've been "redirected too many times." Any tips?

grand quest Jan 23, 2025, 11:00 AM

#

What do I do about the ones that did get served by the origin?

dense lodge Jan 23, 2025, 11:30 AM

#

grand quest What do I do about the ones that did get served by the origin?

Check the logs, this could be legitimate traffic reaching your domain during the attack.

grand quest Jan 23, 2025, 11:31 AM

#

dense lodge Check the logs, this could be legitimate traffic reaching your domain during the...

I did. Quite a few were bots. I can’t access my site even though no new ones are making it through; what now?

dense lodge Jan 23, 2025, 11:35 AM

#

grand quest I did. Quite a few were bots. I can’t access my site even though no new ones are...

"I can’t access my site" - Is your site down due to the attack?
Can you please take a screenshot of the security events for me?

If it is a DDOS attack then CF automatically activates the DDOS protection ruleset

grand quest Jan 23, 2025, 11:44 AM

#

dense lodge "I can’t access my site" - Is your site down due to the attack? Can you please t...

#

This is what I see when going to the site.

#

dense lodge Jan 23, 2025, 11:51 AM

#

I would recommend you to create a rate limit rule.
I don't know what amount of requests is considered normal for your domain but for example:
Create a rule that blocks any IP address that tries to send you more than 700 requests in 10 seconds.

#

Additionally, I would consider blocking "definitely automated" bots through the super bot fight mode.

signal gladeBOT Jan 23, 2025, 12:56 PM

#

DNS over Discord: WHOIS

138.197.83.198
-------------+------------------------------
Name         | DIGITALOCEAN-138-197-0-0     
Registrant   | DigitalOcean, LLC            
ASN          | 14061                        
Registration | Tue, 26 Jan 2016 13:51:21 GMT
CIDR         | 138.197.0.0/16

#I'm getting DDOSed.