Earlier today we experienced a DDoS HTTP attack, which was automatically mitigated by OVH, so only caused minimal disruption. However it's concerning that it happened at all, as all the ips were Cloudflare ips, e.g.:

162.158.202.23 - - [01/Dec/2023:23:30:02 -0500] "GET / HTTP/1.1" 301 244

172.69.90.116 - - [01/Dec/2023:23:30:02 -0500] "GET / HTTP/1.1" 301 244

108.162.221.143 - - [01/Dec/2023:23:30:02 -0500] "GET / HTTP/1.1" 301 244

162.158.235.85 - - [01/Dec/2023:23:30:02 -0500] "GET / HTTP/1.1" 301 244

162.158.110.143 - - [01/Dec/2023:23:30:02 -0500] "GET / HTTP/1.1" 301 244

162.158.110.142 - - [01/Dec/2023:23:30:02 -0500] "GET / HTTP/1.1" 301 244

162.158.202.23 - - [01/Dec/2023:23:30:02 -0500] "GET / HTTP/1.1" 301 244

162.158.202.22 - - [01/Dec/2023:23:30:02 -0500] "GET / HTTP/1.1" 301 244

162.158.202.23 - - [01/Dec/2023:23:30:02 -0500] "GET / HTTP/1.1" 301 244

(it was around 5800 requests per second to a site that normally gets 1 request per second or less at this time of day, and lasted 21.5 minutes).

As it is http, I don't think it could have been spoofed. I tried contacting cloudflare, but they are impossible to contact unless you are a customer. All their social media chat just uses bots and it is impossible to connect to a human if you're not a customer. I tried calling their emergency DDoS line, but the person just said that cloudflare doesn't DDoS people (even though I explained that the attack definitely came from their network, and someone was likely using their service to DDoS us). They simply refused to direct me to anyone else in their company. The phone number is just for people looking to purchase DDoS protection, and they don't have any other method of contacting them.

So, can someone explain why Cloudflare seems to be DDoSing us, and exactly how it happened?

There is no way to report abuse to Cloudflare unless it is a cloudflare website. (I tried, and it refuses to submit the report). I suspect it may be someone abusing their WARP VPN service, but there doesn't seem to be any way of reporting abuse about it.

user:	quags
created:	December 30, 2021
karma:	292