A record of how attackers pivoted to HK/VN/ID/DE after a Singapore Geo Block was applied, and how I switched to a Geo allowlist plus Tencent/Alibaba ASN-based IPSets
An attempt to assign a subdomain managed by an external organization's DNS as a Cloudflare Workers custom domain hit the constraint that Cloudflare's free plan doesn't accept external subdomains as zones. The final solution was to place AWS CloudFront + WAF in front as a termination layer.
A record of blocking bot scraping against a cultural-archive site using AWS WAF, combining Geo block, IPset, JA3 fingerprint, and UA block in stages.
An implementation log of migrating a group of services running on Docker + Traefik, with no downtime, to a CloudFront + WAF-protected setup. I cover naming for the origin-only subdomain, pitfalls with shared Security Groups, the case for starting WAF in COUNT mode, cache design for SPARQL/API traffic, and other recurring decision points.