DDosed even tho we have cf

[DreadPyrateRogers]

Hi
I have a shop website that a competitor keeps ddosing
how to put an end to it?
Cloudflare Free plan does not seem to help
Does the proplan provide any better help?

 

[ReverseEngineering]

Did you enable the "Under attack mode" at Cloudflare already?

 

[TheRealSlimShady]

Hi
I have a shop website that a competitor keeps ddosing
how to put an end to it?
Cloudflare Free plan does not seem to help
Does the proplan provide any better help?

Hello!
DDoS could be bypassed for CloudFlare easily. You should
1) implement rate limits for endpoints that require extensive loading or processing in the backend
2) implement CDN (Content Delivery Network) for static resources like images, CSS, and JavaScript files to offload the server and distribute content closer to users, reducing the impact of DDoS attacks on your origin server. Additionally, consider optimizing your website's performance by minifying and compressing files, enabling caching mechanisms, and leveraging browser caching to reduce server load and improve responsiveness. By implementing these strategies, you can enhance your website's resilience to DDoS attacks even with Cloudflare's Free plan.

 

[DreadPyrateRogers]

Did you enable the "Under attack mode" at Cloudflare already?

yes I did, then I also added rules to block the two biggest countries of origin, Also added some ddos override rules, I redirected to 3 alternative url, which got ddosed, and he seem to have found server ip from a non cf url then the whole server went down with all hosted sites. now i can access cpaneland everything but visitors cant see anything.

 

[DreadPyrateRogers]

Hello!
DDoS could be bypassed for CloudFlare easily. You should
1) implement rate limits for endpoints that require extensive loading or processing in the backend
2) implement CDN (Content Delivery Network) for static resources like images, CSS, and JavaScript files to offload the server and distribute content closer to users, reducing the impact of DDoS attacks on your origin server. Additionally, consider optimizing your website's performance by minifying and compressing files, enabling caching mechanisms, and leveraging browser caching to reduce server load and improve responsiveness. By implementing these strategies, you can enhance your website's resilience to DDoS attacks even with Cloudflare's Free plan.

Thank you I will try this but for now I have to change the ip and hid all url behind cf before optimizing right?

 

[TheRealSlimShady]

Thank you I will try this but for now I have to change the ip and hid all url behind cf before optimizing right?

depending on your configuration, you might directly block all traffic that is not directly from cloudflare as cloudflare acts like a bridge and it's usually common to block all traffic that is not coming from that bridge, in that way, unless exploits of some kind, there is no real need to hide the ip but it would be best practice yes.

 

[DreadPyrateRogers]

depending on your configuration, you might directly block all traffic that is not directly from cloudflare as cloudflare acts like a bridge and it's usually common to block all traffic that is not coming from that bridge, in that way, unless exploits of some kind, there is no real need to hide the ip but it would be best practice yes.

We do very bh niches thats why I worry about ip

 

[TheRealSlimShady]

We do very bh niches thats why I worry about ip

if the domain is required to do bh (i.e. social engineering) that's acceptable, but for example we have some projects where we use no domain at all and issued a certificate only for the IP, as the domain won't be taken down, from your picture tho i assume that won't be the case and that you need a domain, in any case, be sure that cloudflare will investigate and take down not only the domain but the hosting as well at the first report and investigation, this is why we have migrated to a domain-less setup for our services.

 

[captchakiller]

Its possible that they somehow found the IP of your server and are ddosing your server?

 

[DreadPyrateRogers]

if the domain is required to do bh (i.e. social engineering) that's acceptable, but for example we have some projects where we use no domain at all and issued a certificate only for the IP, as the domain won't be taken down, from your picture tho i assume that won't be the case and that you need a domain, in any case, be sure that cloudflare will investigate and take down not only the domain but the hosting as well at the first report and investigation, this is why we have migrated to a domain-less setup for our services.

Interesting, So routing all traffic through cf is the first step i try and let you know

 

[DreadPyrateRogers]

Its possible that they somehow found the IP of your server and are ddosing your server?

Yes they found the ip abd they are even blackmailing me to stop ddos lol

 

[TheRealSlimShady]

Yes they found the ip abd they are even blackmailing me to stop ddos lol

in this case then it's best you first fix any potential leakage, block anything other than cf's traffic and you should be set. make sure the system is not sending out any email that might contain the ip in the header as well or systems like that that could leak your ip and good luck in your endeavours

 

[captchakiller]

Yes they found the ip abd they are even blackmailing me to stop ddos lol

Maybe contact your hosting to change your IP and figure out how they found it, then make sure all traffic comes from cloudflare.
This is actually very common now even for bigger businesses, ddos and blackmail.

 

[DreadPyrateRogers]

Maybe contact your hosting to change your IP and figure out how they found it, then make sure all traffic comes from cloudflare.
This is actually very common now even for bigger businesses, ddos and blackmail.

Ok thanks a lot
I will do that

 

[zakservers]

Most probably they have find out your real IP, behind the cloudflare proxy and they are DDoS it directly, as you can see from your cloudflare management page, if there are any alerts of any incoming attack, if there are none, then CF has nothing to do with it, as they are directly attacking your server, but if they have already figured out your real IP, changing IP and again using cloudflare wont help, as they can again trace it and start attacking it direct, I would recommend you to choose some sort of protected on the server level, either ask your host if they can provide you with DDoS protection, or install a firewall or use any other server level DDoS protection mechanism.

 

[DreadPyrateRogers]

Most probably they have find out your real IP, behind the cloudflare proxy and they are DDoS it directly, as you can see from your cloudflare management page, if there are any alerts of any incoming attack, if there are none, then CF has nothing to do with it, as they are directly attacking your server, but if they have already figured out your real IP, changing IP and again using cloudflare wont help, as they can again trace it and start attacking it direct, I would recommend you to choose some sort of protected on the server level, either ask your host if they can provide you with DDoS protection, or install a firewall or use any other server level DDoS protection mechanism.

Reusing clouflare with new ip and routing all through cf worked

 

[Deleted member 183008]

Looks like i am facing the same issue, "under attack mode" is on but still my servers are getting down.

 

[rdp.monster]

Looks like i am facing the same issue, "under attack mode" is on but still my servers are getting down.

Blocks all traffic not coming from CloudFlare and configures WAF rules.

(Security menu -> WAF)
There are quite a few examples of WAF rules on the Internet that allow you to "block attacks", well... rather limit them

 

[DamoHG]

Is your website accessible via direct IP? eg if your VPS IP is 192.168.0.100 does http://192.168.0.100 load

If so install a firewall like csf and whitelist Cloudflare IP ranges https://www.cloudflare.com/en-gb/ips - Then only CF can access the website via direct IP

 

[DreadPyrateRogers]

Is your website accessible via direct IP? eg if your VPS IP is 192.168.0.100 does http://192.168.0.100 load

If so install a firewall like csf and whitelist Cloudflare IP ranges https://www.cloudflare.com/en-gb/ips - Then only CF can access the website via direct IP

Thank you i will do that today