Hey guys, I seem to be getting 'attacked' by random bots? I guess, My website / online store is based in Australia and using Prestashop Geolocation have allowed Ip addresses within Au to access it. However based on the above there was 1.2M hits over night from the usual suspects.
Part of it was Claude-Searchbot was not blocked and have allowed 1.03GB of data to access / transfered. I would say this attack is causing the website to shit itself.
Any advise on what I should be looking at to block these overseas ppl.
For faster advice with technical questions, we'd recommend asking in the Orange Cloud Discord server; the unofficial Cloudflare Discord server by the community, for the community. https://discord.gg/TrPNVKaagR
Since this is PrestaShop, I’d move the filtering in front of the application rather than rely on PrestaShop Geolocation, by the time that code rejects a visitor, the request may already have consumed origin/PHP resources. In Cloudflare Security Analytics, break the spike down by country/ASN, path and bot type, then challenge or block the abusive pattern at the edge. I wouldn’t blanket-block every non-AU request though: legitimate search crawlers can come from overseas, so exempt verified search bots and treat AI Search/Training separately. That should reduce origin load without accidentally hurting indexing.
I've had to get the hosting company to do stuff for me on CloudFlare as what I did didn't fix anything. I've had to activate under attack mode too and I can see the traffic has lessened by 7m hits.
Thanks - I will check it again in 24 hours and see if the hits have dropped. I encountered something like this last year, but I guess they are finding new ways
Blocking AI bots probably didn't move the needle because most of that traffic isn't AI bots.
A user-agent is a claim, not an identity. Anything can send "Claude-Searchbot", and scrapers borrow well-known crawler names precisely because people allowlist them. Cloudflare's AI-crawler controls are built around crawlers it can positively identify; something merely wearing the name is a different classification problem and tends to land in generic bot or unknown traffic instead. That would explain a rule that reads as on while the volume doesn't change.
The volume is the other tell. Claude-Searchbot fetches a page when someone asks Claude something that needs it, so it's low and bursty. 1.03GB overnight against one PrestaShop store isn't that shape.
So I'd stop treating it as a bot-category problem. In Security Analytics, take the requests claiming a crawler user-agent and split them by verified vs unverified rather than by bot type. Then one custom WAF rule, challenge or block anything claiming to be a crawler that Cloudflare hasn't verified, catches every impostor at once, including whichever name they borrow next week. A rate limiting rule does a blunter version of the same job and you get one on the free plan.
Two things worth not losing while you tighten up. +1 to Sunn_M on getting the geo filter off PrestaShop and onto the edge, because at 1.2M hits that's the difference between PHP running a million times a night and not. And when you do start blocking verified crawlers, make that a deliberate decision rather than part of the cleanup, because some of them are why a store turns up when someone asks an assistant for a recommendation. Blocking the fakes costs you nothing either way.
•
u/AutoModerator 1d ago
For faster advice with technical questions, we'd recommend asking in the Orange Cloud Discord server; the unofficial Cloudflare Discord server by the community, for the community. https://discord.gg/TrPNVKaagR
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.