Stack Overflow under attack: what we learned about handling DDoS attacks
stackoverflow.blog/2022/05/16/sta
Conversation
Replying to
When using HAProxy you can also try to leverage TLS/JA3 fingerprints (haproxy.com/blog/announcin)
While it can still be spoofed using several packages , e.g. github.com/Danny-Dasilva/ it can still provide a meaningful/easy-to-manipulate signal.
1
Moreover, most bots conducting L7 DDoS don't use real/headless browsers in order to be able to scale their attack, so it's highly likely they'll have a discriminating/inconsistent TLS fingerprint
1
This can also be done directly in Fastly using e.g. developer.fastly.com/reference/vcl/
Another approach to proactively flag malicious IPs is to scrape free proxies. Indeed, most DDoS leverage lot of cheap/know bad IPs. It's frequent to see these free proxies in these attacks.
However, it's risky to block all free proxies by default since some of them may be shared residential IPs. In this case, a simple/less risky solution is to adopt a more agressive rate limiting on these IPs.