If you're challenging certain countries and still want to let humans through, you can add a second http version criteria. these bots use http/1.1 while humans on modern browsers will tend to use http/3 if you have it enabled in cloudflare.
Regular bots and crawlers like googlebot also appear to use http/1.1, so it's best to use it along with the country filter
EDIT: as per cloudflare (https://radar.cloudflare.com/adoption-and-usage), less than 10% of traffic uses http/1.x. I found something similar on my forums before these bots. During these attacks, it goes to >99%
Code:
(ip.src.country in {"BD" "BR" "VN" "IN"} and http.request.version in {"HTTP/1.1" "HTTP/1.0"})EDIT: as per cloudflare (https://radar.cloudflare.com/adoption-and-usage), less than 10% of traffic uses http/1.x. I found something similar on my forums before these bots. During these attacks, it goes to >99%
Statistics: Posted by d1g1t — Tue Jul 29, 2025 5:18 am