Detecting DDoS
Hey, is there any way triggering a Webhook so i get a Message when a Domain is probably ddosed?
16 Replies
There is a notification for an HTTP DDoS Attack (under Notifications account level in the dashboard), and you can use webhooks with notifications if you have at least one paid feature
The alerts are documented here: https://developers.cloudflare.com/ddos-protection/reference/alerts/#alert-types
Webhooks: https://developers.cloudflare.com/notifications/create-notifications/configure-webhooks/
Okay thanks. Because my Plan is to send a Discord Webhook when my Service gets a DDoS, you know
@Chaika Hey, thanks for your help. I added some Notifications and get them now via email. But i cant find the place, where i can adjust and configure the webhooks 
do i need a Plan or something like that?
do i need a Plan or something like that?Webhooks require your account to have at least one paid feature https://developers.cloudflare.com/notifications/create-notifications/configure-webhooks/ like Pro for example
Configure webhooks · Cloudflare Notifications docs
This feature is only available if your account has at least one paid feature. For more information, refer to our plans page .
Is there anything cheap i can pay to get it?
hmm I don't know if the usage based subs like r2/etc count. If you wanted to do it for free, and you had a spare website in Cloudflare, you could enable email routing on it, and setup an Email Worker on "secret" email address which sends a webhook to your Discord. You'd have to do some coding/wrangler stuff if you're comfortable with that, example of an email worker that would let you do that: https://github.com/Tyler-OBrien/cloudflare-worker-emails-to-discord
Okay thanks
What exactly is a Zone Name? is it like the domain name?
Is there more context to that?
Zones in Cloudflare is anything under the "Websites" tab, so yea you could say it's like a domain name, free plan can only add entire domains as Websites/Zones. If you're looking for your zone ID, bottom right of the overview page
Ziel-Hostname and Zielzone is just fake-zone-name
If you had "example.com" added as a website in Cloudflare, and a subdomain like "cookies.example.com", and it got attacked, Zielzone would be "example.com" and ziel-hostname would be "cookies.example.com"
ah okay, so if i want to get all notifies filtered for modguard.xyz i check if zielzone is modguard.xyz?
that's what it would be, yea
👍
Next Step: Cloudflare Maintenance