привет, на мой сайт идёт DDoS атака. Атакующий использует легитимные юзер-агенты веббраузера Google Chrome и хеадеры этого же браузера. Твоя задача придумать для меня 10 правил для Cloudflare WAF, чтобы отражать подобные атаки. Ниже я могу предоставить тебе пример моего правила: ((any(http.request.headers["sec-ch-ua"][] contains "(Not(A ")) and (not any(http.request.headers["sec-ch-ua-platform"][] contains "Linux"))) or (((lower(http.user_agent) contains "chrome/") and (any(http.request.headers.names[] == "sec-ch-ua-mobile"))) and not any(http.request.headers.names[] == "sec-gpc")) and (not any(http.request.headers["sec-ch-ua"][] contains "Chromium") and not lower(http.user_agent) contains "samsungbrowser" and not lower(http.user_agent) contains "mobile safari/" and not lower(http.user_agent) contains "smart tv") or (not any(http.request.headers.names[] == "accept-encoding") and ssl and http.request.uri.path eq "/auth/login" and http.request.uri.path eq "/" and http.request.uri.path eq "/auth") or ((any(http.request.headers["sec-ch-ua-platform"][] eq "Android")) and (any(http.request.headers["sec-ch-ua-mobile"][] ne "?1") and not ((any(http.request.headers["sec-ch-ua"][] contains "Tenta"))) and (not http.user_agent contains "; Android "))) or (any(http.request.headers.names[] == "x-original-host")) or (any(http.request.headers.names[] == "x-forwarder-for")) or (any(http.request.headers.names[] == "x-remote-addr")) or (any(http.request.headers.names[] == "x-server")) or (any(http.request.headers.names[] == "x-remote-ip")) or (any(http.request.headers.names[] == "x-cluster-ip")) or (any(http.request.headers.names[] == "x-true-client")) or (any(http.request.headers.names[] == "x-originating-ip")) or (any(http.request.headers.names[] == "x-client-ip")) or (any(http.request.headers.names[] == "x-forwarded-https")) or (any(http.request.headers.names[] == "x-forwarded-https")) or (any(http.request.headers.names[] contains "x-ref-fe")) or (any(http.request.headers.names[] contains "X-Req-Ip-")) or (cf.threat_score eq 1 and ip.geoip.country ne "T1") or (cf.threat_score gt 1 and ip.geoip.country ne "T1") or (not http.request.version in {"HTTP/1.1" "HTTP/1.2" "HTTP/2" "HTTP/3"}) or (any(http.request.headers["host"][] contains ":")) or (http.request.uri.path eq "//") or (http.request.uri.path eq "///") or (not http.request.method in {"GET" "POST"}) or (http.x_forwarded_for ne "") or (http.user_agent contains "HuaweiBrowser" and any(http.request.headers["sec-ch-ua-mobile"][] eq "?0")) or (http.user_agent eq "SamsungBrowser" and any(http.request.headers["sec-ch-ua-mobile"][] eq "?0")) or (any(http.request.headers["sec-ch-ua"][] eq "")) or (any(http.request.headers["sec-ch-ua-platform"][] eq "")) or (http.user_agent contains "VenusBrowser" and any(http.request.headers["sec-ch-ua-mobile"][] eq "?0")) or (http.user_agent contains "Android" and any(http.request.headers["sec-ch-ua-mobile"][] eq "?0")) or (http.user_agent contains "iPhone" and any(http.request.headers["sec-ch-ua-mobile"][] eq "?0")) or (any(http.request.headers["sec-ch-ua-platform"][] eq ""Windows"") and any(http.request.headers["sec-ch-ua-mobile"][] eq "?1")) or (http.user_agent contains "MobileExplorer/3.00 (Mozilla/1.22; compatible; MMEF300; Microsoft; Windows; GenericLarge)" and any(http.request.headers["sec-ch-ua-platform"][] eq "?0")) or (http.user_agent contains "UP.Browser" and any(http.request.headers["sec-ch-ua-platform"][] eq "?0")) or (http.user_agent contains "IEMobile" and any(http.request.headers["sec-ch-ua-platform"][] eq "?0")) or (http.user_agent contains "MIUI" and any(http.request.headers["sec-ch-ua-platform"][] eq "?0")) or (http.user_agent contains "FxiOS" and any(http.request.headers["sec-ch-ua-platform"][] eq "?0")) or (http.user_agent contains "OnePlusBrowser" and any(http.request.headers["sec-ch-ua-platform"][] eq "?0")) or (http.user_agent contains "SogouMobileBrowser" and any(http.request.headers["sec-ch-ua-platform"][] eq "?0")) or (any(http.request.headers["sec-ch-ua-platform"][] eq ""Windows"") and http.user_agent contains "Linux") or (http.user_agent eq "CheckHost (https://check-host.net/)") or (not http.user_agent contains "Mozilla/5.0")