3 ms·

hello, imho. this sounds like a ddos... maybe the ip address(es) of the requests are spoofed!? this could be given you mentioned, that the request didn't sto

hello, imho. this sounds like a ddos... maybe the ip address(es) of the requests are spoofed!? this could be given you mentioned, that the request didn't stop after you blocked them at nginx/ipt/... level for this ip/ip-range!? idk ... set up nginx's rate-limiting? * https://www.nginx.com/blog/rate-limiting-nginx/ https://www.nginx.com/blog/rate-limiting-nginx/ which OS do you use? if its linux and you are able to access the OS itself, (additionally) setup a rate-limit at ip-level for the machine? * https://www.baeldung.com/linux/iptables-packet-rate-limit https://www.baeldung.com/linux/iptables-packet-rate-limit or even ask your upstream-provider to help/configure its ddos-protection properly!? just my 0.02€

LinuxBender 2y ago
If it's TCP HTTPS and making established connections then it is not spoofed. Spoofed TCP connections will be SYN packets but a TCP handshake and TLS handshake will not complete. More likely someone abusing a proxy capability of Cloudflare which is why reporting it to them along with logs is very important. They process massive amounts of traffic so logs with accurate timestamps NTP correctly running on the web server are important to find the needle in the haystack.