Cloudflare Security WAF Rules

(ip.geoip.country eq "T1") or (ip.geoip.country eq "XX") or (http.request.version in {"HTTP/1.0" "HTTP/1.1"})

ekstra olarak Yurt dışı kaynaklı yoğun istek alıyorsanız bunuda ekleyebilirsiniz
(not ip.geoip.country in {"TR"})

Choose action: Block Olarak ayarlanmalıdır

(ip.geoip.asnum in {45090 37963 8100 39369 14618 14061 51167 32934 8866 9009 9808 51396 141995 8075 24940 136907 63949 211252 266935 395954 210228 141039 49943 54203 8881 20001 3352 57523 51852 396073 16509 35916 36352 46308 5617 14061 63949 12389 55720 17451 38244 19318 211760 47583 38031 141889 45317 22363 327901 44217 31898 396982})

Choose action: Block olarak ayarlanmalıdır

(http.request.uri.query eq "d=1") or (http.request.uri.query eq "--+") or (http.user_agent eq "d1b2df322c91") or (http.user_agent eq "109e15941c57") or (http.user_agent eq "84bd2cfee733") or (http.request.full_uri contains "/.env") or (http.request.full_uri contains "/.git") or (http.request.full_uri contains "fI4y") or (http.request.full_uri contains "\\x02") or (http.request.full_uri contains "MGLNDD_") or (http.request.uri.query eq "daksldlkdsadas=1") or (http.request.full_uri contains "\\x00\\x00\\x00") or (http.request.full_uri contains "SSTP_DUPLEX_POST") or (http.request.full_uri contains "sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}") or (http.request.full_uri contains "v\\xF0m\\xB0b\\xAF\\x8F\\x883\\xE4U)8\\x99E\\x14") or (http.request.full_uri contains "-\\x11\\xBERB#:\\xE4.\\xC6\\xFFHA\\x1A\\x03\\xD7") or (http.request.full_uri contains "T\\x83\\xF8\\xCCu\\x18\\xA8\\xABw*w\\xF5j\\x91\\xE4[") or (http.request.full_uri contains "j\\x00\\xFD U\\x8De\\xC2G\\xB6\\x9A\\x83g\\xA3-\\xB6") or (http.request.full_uri contains "\\x00\\x0E8\\x89\\x99\\xDCZFS\\xEDM\\x00\\x00\\x00\\x00\\x00") or (http.request.full_uri contains "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00") or (http.request.full_uri contains "\\x03\\x00\\x00/*\\xE0\\x00\\x00\\x00\\x00\\x00Cookie: mstshash=Administr") or (http.request.full_uri contains "\\x03\\x00\\x00\\x13\\x0E\\xE0\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x08\\x00\\x03\\x00\\x00\\x00") or (http.request.full_uri contains "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00") or (http.request.full_uri contains "!\\xFA\\xAC\\x8E\\x12^\\x87\\x1F9E\\xF8\\xBBT5\\x18\\xBF\\xE3\\x0Fc\\xB0\\xC3+!\\xB0y\\xA7\\xE0\\x1B\\xCF+!\\xB0\\xC2/c\\xB0\\xC3+\\x22\\xB8\\xC3+!\\xB0\\xC3+!\\xB0i+!\\xB0\\xC3+") or (http.request.full_uri contains "o\\xFA\\xC0\\xBE\\xB8\\xC0\\xA4\\xC9\\x89\\xA2\\xC2\\x8F\\x83\\xAF\\x91\\x97\\xBE\\xCD\\xB9\\xCF\\xAC\\x9B\\xB0\\xAB\\xA0\\xB6\\xB1\\xAA\\x9D\\x9C\\x9F\\x96\\x8D\\x93\\xCE\\xB4\\xB3\\xB5\\x98\\xCD\\xA6\\xFA\\xFA\\xFA\\xFA\\x12\\xFD\\xD8\\xF8\\xFA\\xFA\\xC2\\xFA\\xFA\\xFA\\xFA\\x1Af\\xEC\\xF9\\xFA\\xFA\\xFA\\xFA\\xFB\\xE5q\\xF2\\xFA\\xFA\\xFA\\xFA\\xFA\\xFA\\xF9wh\\x97ui\\xBA\\xEA=E\\xF0\\x1B/\\xA7XJ\\xF11Y\\x0B\\xBF\\xB1K\\x1F\\x00\\xFA\\xF8\\xAF5Y\\xDB\\xA1\\xA2 \\xE00\\xCC\\xBAU]<\\x15\\x14\\xBA\\xC7W7c\\x02\\x98\\xC996\\x95\\x1C\\xC5\\x164yR\\xE7\\x8C\\x90\\x8E\\x06\\x92w\\xCD\\xE9\\x0E\\x14!\\x19\\x87KE\\xE1\\x86 ,)\\xEA\\x85_\\x16I(\\x86\\x8B?\\xADXx\\xD7\\xE7\\xB67\\x83\\xF1\\xFC;\\x83\\xC8\\x0F\\xAE\\xDD\\x1A\\xCA\\xBF\\xD3\\xF0\\x98\\xAA\\xD9=\\xD0\\xD0\\xD6\\xEF\\xABQZ`\\xBCrhc@[\\x9Cz\\xEA\\x8AJ|\\x8F\\xEF\\x86V\\x11\\xDC\\xBB\\x5C\\xF8T\\xF3=\\x9B\\xAF\\x11\\xBD8\\x96\\xAD\\xE7e~`ov\\xCC\\xB6\\xCA\\xDE\\xB78\\xDC\\xD88w9\\x91\\x8C\\xD1\\xDE/\\x98\\xCA\\x8D%\\xDC\\x85+sb\\xAE\\xE5&\\xCA\\x08\\x06\\xFF\\x9Ev\\xA5\\x96\\xED\\x0F\\xBC\\xEA2\\xFA\\x1F7\\x03\\xC9g\\x83)TF$H\\xA8\\xD2\\xA24\\x91\\x80\\xABg\\x0CF+\\xBFx*w\\x19\\x01\\x0E\\xFF\\xCF\\x1B\\xA8\\x9AJrF.\\x0B\\x9D\\x84\\xF2\\xEE\\x80Y\\x18\\xD4\\x12\\xFE\\x14\\x89\\x9B\\x8C\\x9AL6\\x17\\x09\\xF25\\x5C\\xEDb\\x02\\x89\\xCD\\xA7|\\xC9zL\\x97\\x81\\x92\\x96\\xA3\\xC4g\\xB4(\\xE3k\\x82Gk\\xC1\\x90B\\xE6][\\xE1\\x02\\x9B\\x86?Tua\\x1C\\xE0\\xFC\\x9F\\x8D\\xEB\\x01\\xAB\\xC0\\xE5\\xD6\\x98\\xD5\\xE0<\\x93\\xEA\\x00\\x8DT\\xE9\\x05\\x04y-G\\x0E\\xC5R\\x0E\\x18\\xF4\\xC1\\xD6\\x8E\\xBDi\\xBBf\\xBC1Z-\\xFD\\x90N\\x16\\x81\\x07C*mk\\x11\\xBCZ\\x02\\x85\\x95a\\xDE\\xAB\\xA8\\xB7\\xA3\\xA7;\\x19\\xDE\\xB3\\xD7")

Choose action: Block olarak ayarlanmalıdır

(cf.threat_score gt 5) or (http.request.version in {"HTTP/1.0"} and not cf.client.bot) or (http.user_agent contains "scrapy" and not cf.client.bot) or (http.user_agent contains "spider" and not cf.client.bot) or (http.user_agent contains "crawl" and not cf.client.bot) or (http.user_agent contains "Go-http-client") or (http.user_agent contains "quic-go-HTTP") or (http.x_forwarded_for contains "192.0.") or (http.x_forwarded_for contains ".0.0") or (http.user_agent contains "fasthttp") or (http.user_agent contains "ALittle") or (http.user_agent contains "python") or (http.user_agent contains "'XOR(") or (http.user_agent contains "got (") or (http.user_agent contains "Nmap") or (http.user_agent contains "java") or (http.user_agent contains "PHP") or (http.user_agent contains "/x/") or (http.user_agent eq " ") or (http.user_agent eq "-") or (http.user_agent eq "'") or (http.host contains ":80") or (http.host contains ":443") or (http.user_agent contains "lient" and http.user_agent contains "ttp") or (http.user_agent contains "wrk") or (http.user_agent contains "hey/") or (http.user_agent contains "libweb") or (http.user_agent contains "libwww") or (ip.geoip.country in {"T1" "XX"} and not http.request.version in {"HTTP/2" "HTTP/3" "SPDY/3.1"} and not cf.client.bot) or (http.cookie contains "cf_use_ob=" and not http.cookie contains "0" and not http.cookie contains "80" and not http.cookie contains "443" and not cf.client.bot)

Choose action: Block olarak ayarlanmalıdır