Stack Overflow under attack: what we learned about handling DDoS attacks
stackoverflow.blog/2022/05/16/sta
Conversation
Replying to
When using HAProxy you can also try to leverage TLS/JA3 fingerprints (haproxy.com/blog/announcin)
While it can still be spoofed using several packages , e.g. github.com/Danny-Dasilva/ it can still provide a meaningful/easy-to-manipulate signal.
1
Moreover, most bots conducting L7 DDoS don't use real/headless browsers in order to be able to scale their attack, so it's highly likely they'll have a discriminating/inconsistent TLS fingerprint
1
This can also be done directly in Fastly using e.g. developer.fastly.com/reference/vcl/
Another approach to proactively flag malicious IPs is to scrape free proxies. Indeed, most DDoS leverage lot of cheap/know bad IPs. It's frequent to see these free proxies in these attacks.
1
However, it's risky to block all free proxies by default since some of them may be shared residential IPs. In this case, a simple/less risky solution is to adopt a more agressive rate limiting on these IPs.