T00ls持续遭受DDoS攻击，征集拦截规则与思路 - 论坛事务(Forum Affairs) - T00ls

#1

国庆假期间，T00ls持续遭受DDoS攻击，给大家造成了极差的访问体验。

[img]attachments/month_1607/1607281807d4bb851541e353b4.jpg[/img]

在 @y35u 支持下，已经升级Cloudflare专业版本。感谢夏老师！

目前可以在Cloudflare配置20条自定义规则。在此征集Cloudflare防护的规则，希望大家结合自己的防护经验提供一些参考，谢谢！

以下为日志样本。

172.69.64.245 - - [07/Oct/2023:06:53:15 +0000] "GET /?BozujM=mA5nwgs8Ib3TmioE4HTCYki53oa2RCxg20AiwJra6AW41RH5ShDopJt1cmJWWieN9hmHyliQtDMWJMAPKjP5TKq8mq7hURFVj23YmDArhINElQocqaHm8OSkiKPfiOg46qXB1H8QtGsTiwGIFwmM9fjw6nn59SCndyLa6Efwt70NIW2mmmHtVLD2KgVHYJL3vT0v1zaw HTTP/1.1" 200 723 "http://ddosvn.somee.com/f5.php?v=" "Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/110.0" "182.72.84.51,64.189.106.6"
172.71.215.10 - - [07/Oct/2023:06:53:15 +0000] "GET /?VseaWV=yD7PS8IXvLmvihsx9B0qlIrrrOZ6y6CbF7J0IeIg9dl4NKvaB7fohelJ4WhSOfUExyvbbrHMyTboTUYqQfZ08i1xQXi1YWVUOxcLwAGbM18qo0nZSB8isxaGl1LDAIrQkZWapwwhau92VfjAc0BpQPz9TksaEd0E2xFeTzzAOvfK2lxxkN1aZqGat2YASGnYEZnZ2tX3 HTTP/1.1" 200 723 "http://engadget.search.aol.com/search?q=query?=query=&q=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 Edg/111.0.1661.54" "124.78.45.82,103.242.104.28"
162.158.186.67 - - [07/Oct/2023:06:53:15 +0000] "GET /?GH76dm=66IQ4uuGj9RWKOE1HT5qZMeREReGZTsbWTLku6DDDapWmSxgMbNTuNyan6B1Viju4XarSEpwuKLjmeftEYgJoyucEfChfrWZOJVzBlh09fvGs07txEndsF5Oi91fgLW5sKXze60ladAHFjhMtm2XG0Mjk0UpzQAh1eVVZKBLCPsPjBPA7N66sFXvy99XvfP6PhES5HR2 HTTP/1.1" 200 723 "http://go.mail.ru/search?gay.ru.query=1&q=?abc.r&q=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0" "125.93.38.169,23.234.242.252"
172.71.222.185 - - [07/Oct/2023:06:53:15 +0000] "GET /?GFm0n6=RU2wWqGpLY2kK9ffrGVs4FbcvyVsAprHJ3XiSeNnYiKolMo8MK1ZdFRJizEBCfaMEmzuGl4ZabI4bq5tOOXkESugY25L9AJS106uwcRYTBtNLyOT9fhYWjPTvCPMU8dLOL4sL5QA7yyiIX62U8PoSCrhblCFYf0NouopcXGqaaS8gNE9MFaBXR8xZmAJIqWtokzLLXhP HTTP/1.1" 200 723 "http://eu.battle.net/wow/en/search?q=" "Mozilla/5.0 (Windows NT 10.0; rv:111.0) Gecko/20100101 Firefox/111.0" "134.39.30.87,111.225.152.17"
162.158.18.103 - - [07/Oct/2023:06:53:15 +0000] "GET /?VseaWV=yD7PS8IXvLmvihsx9B0qlIrrrOZ6y6CbF7J0IeIg9dl4NKvaB7fohelJ4WhSOfUExyvbbrHMyTboTUYqQfZ08i1xQXi1YWVUOxcLwAGbM18qo0nZSB8isxaGl1LDAIrQkZWapwwhau92VfjAc0BpQPz9TksaEd0E2xFeTzzAOvfK2lxxkN1aZqGat2YASGnYEZnZ2tX3 HTTP/1.1" 200 723 "http://engadget.search.aol.com/search?q=query?=query=&q=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 Edg/111.0.1661.54" "124.78.45.82,193.231.40.182"
172.70.42.220 - - [07/Oct/2023:06:53:15 +0000] "GET /?TVs6Hn=FzTdyd5RvL9BmlljzCTp7CFR5GWWl7nlyQgiMQHmU4He7fk0EVB6gSclcn606zjAw4lKJ0LEgjaUkpmQiS0taXE2n3kjj0ZDv5TSEZmmtOBTQOdD4Ok1iarv4FqMvHRaq5dDnsih0OV5vZyajuBIpU78ydMAeIXGhiA2EqcIFXnFaBTO8HFCqSm21SdQOOK2gUbwBmQi HTTP/1.1" 200 723 "http://ddosvn.somee.com/f5.php?v=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36 Edg/112.0.1722.34" "76.78.199.245,60.175.9.77"
108.162.227.53 - - [07/Oct/2023:06:53:15 +0000] "GET /?njtWjy=A8rratVlBqQ2yE9e0fMCLWsM1QOv1TEfl9GQfXJZEotFchbnRDLnjt2KOJubeyGqu6NB2dNeQU54pZVBzI3CMGv0aLnddCI4GONrUtOHKXUvvQDi0S1zERKqW8aOn3Ep4hMtK9Jo52NtbxY66GSmZYzK1E6RMZlyuyuB4n62KXpTGeF5F8HL1fY0BdkLRHBHowdzoo9K HTTP/1.1" 200 723 "http://eu.battle.net/wow/en/search?q=" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36" "198.181.167.216,103.166.10.136"
162.158.162.92 - - [07/Oct/2023:06:53:15 +0000] "GET /?4Dn0hq=69tb05D7jPsil2xE5yK9bU47XkxWdq8bo4D0LTcJ9kxucxQRwL1UJVZseAgdpOg9eyLV0JlAe22QMPx5FOK7mBzKPkebaTdeYQju0lawNaHKvGbvnXWaaizerRKMvoKWrrj5roXI5mU6G2y597bCpOBDe75F2mXLSKYX08f9fSZuLlI1r75Bc5RZTxggbIjkSJZqBNbQ HTTP/1.1" 200 723 "http://filehippo.com/search?q=" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36" "96.187.82.223,103.191.165.59"

T00.ls：https://t00.ls/t00ls
T00ls官方Telegram公开频道：https://t.me/T00lsCom
T00ls官方Telegram群：https://t.me/T00lsTB
T00ls官方Twitter：https://twitter.com/T00lsCom