4 ms·
More than likely someone with a high traffic site fat fingered an IP address and sent all the traffic to you. I am curious if you were able to capture the head
by georgyo 3y ago
More than likely someone with a high traffic site fat fingered an IP address and sent all the traffic to you.
I am curious if you were able to capture the headers at all. The 'Host' header would allow you to figure out the site these people were actually trying to hit. I'm fairly confident it was not your domain. You may want to to put the Host header in your access logs. This may also explain why everyone got a 301 and using http.
No matter what you should be able to see this header 'Cf-Connecting-Ip' to know the true source.
While cloudflare is somewhat masking the origin IPs, a similar mistake without cloudflare would send at least the amount of traffic towards you.
- hartator 3y agoYes, I agree. And if all requests are from the homepage, why not adding a header to ask Cloudflare to cache it for 1 day?
- cpncrunch 3y agoThat doesn't seem like a solution to a DDoS attack that is automatically mitigated .
- freitasm 3y agoYes, very likely. The website owner might not even realise if they use more than one IP address, which are then presented in a round-robin way to clients, so errors loading the pages aren't easily spotted. If you find out the hostname used you could try contacting the website owner and check with them, bypasing Cloudflare (assuming you could either load the site and use a contact form, or find registrant's information).
- cpncrunch 3y agoI think that is unlikely, as the logs only show the 301 redirect, but not the request to load the site itself. And it only ever loaded the main home page (/).