Cara Menangani Cloudflare Under Attack Mode

"I'm Under Attack Mode" (IUAM) Cloudflare adalah pertahanan DDoS yang memaksa setiap pengunjung melalui JavaScript challenge 5 detik sebelum mengakses situs. Ini adalah mode perlindungan Cloudflare paling agresif, dipicu secara manual oleh operator situs saat serangan atau diaktifkan permanen di situs berisiko tinggi. Untuk akses otomatis, IUAM menciptakan JavaScript challenge wajib yang tidak dapat dilewati oleh klien HTTP biasa.

Apa yang Dilakukan IUAM

Saat operator situs mengaktifkan "I'm Under Attack Mode" di dashboard Cloudflare:

Every request → Cloudflare edge
    ↓
JavaScript challenge page served (HTTP 503)
    ↓
Browser executes JavaScript challenge (~5 seconds)
    ↓
Challenge answer submitted automatically
    ↓
qa_validation_cookie cookie set
    ↓
Original page loaded with qa_validation_cookie cookie

Halaman Challenge IUAM

Halaman challenge mengembalikan HTTP 503 dan berisi:

Karakteristik Utama

• HTTP 503 kode status (BUKAN 403)
• Wajib tunggu 5 detik sebelum submit challenge
• Eksekusi JavaScript diperlukan — klien HTTP biasa gagal
• Cookie qa_validation_cookie — valid ~30 menit, memungkinkan request berikutnya
• Seluruh domain — setiap halaman di domain menampilkan challenge

Mengidentifikasi IUAM vs Perlindungan Cloudflare Lainnya

import requests

def identify_cloudflare_protection(url):
    """Distinguish IUAM from other Cloudflare protections."""
    headers = {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) "
                      "AppleWebKit/537.36 Chrome/120.0.0.0",
    }

    response = requests.get(url, headers=headers, timeout=15, allow_redirects=False)
    html = response.text
    status = response.status_code

    if status == 503 and "jschl" in html:
        return "IUAM (I'm Under Attack Mode)"

    if status == 503 and "challenge-platform" in html:
        return "Managed Challenge"

    if status == 403 and "cf-ray" in str(response.headers):
        return "Blocked by WAF/Bot Management"

    if "cf-turnstile" in html:
        return "Turnstile widget"

    if "challenges.cloudflare.com" in html:
        return "Cloudflare challenge (generic)"

    if status == 200:
        return "No challenge (passed)"

    return f"Unknown (status: {status})"

Tabel Deteksi

Cara Kerja JavaScript Challenge

JavaScript challenge IUAM dirancang untuk memverifikasi bahwa pengunjung memiliki browser asli:

Alur Challenge

1. Cloudflare menyajikan halaman challenge dengan JavaScript yang diobfuskasi
2. JavaScript melakukan komputasi: - Operasi matematika pada string dari halaman - DOM measurement - Penegakan timing (minimal 4–5 detik)
3. Jawaban dihitung — nilai numerik berdasarkan challenge
4. Form disubmit secara otomatis ke Cloudflare dengan jschl_vc, pass, dan jschl_answer
5. Cloudflare memvalidasi jawaban dan timing
6. Cookie qa_validation_cookie dikembalikan — memungkinkan akses selama ~30 menit

Mengapa Klien HTTP Gagal

# This will ALWAYS get the challenge page:
import requests
response = requests.get("https://iuam-protected-site.com")
# response.status_code == 503
# response.text contains "Checking your browser..."

# Plain HTTP clients cannot:
# - Execute JavaScript
# - Compute the challenge answer
# - Meet the timing requirement
# - Generate the required cookies

Solve IUAM dengan CaptchaAI

Metode 1: Cloudflare Challenge Solver (disarankan)

Metode cloudflare_challenge CaptchaAI menangani IUAM challenge secara langsung:

import requests
import time

API_KEY = "YOUR_API_KEY"
TARGET_URL = "https://iuam-protected-site.com/data"

# Step 1: Submit challenge to CaptchaAI
submit = requests.post("https://ocr.captchaai.com/in.php", data={
    "key": API_KEY,
    "method": "cloudflare_challenge",
    "sitekey": "managed",
    "pageurl": TARGET_URL,
    "json": 1,
})

task_id = submit.json()["request"]
print(f"Task submitted: {task_id}")

# Step 2: Poll for result
for attempt in range(60):
    time.sleep(5)
    result = requests.get("https://ocr.captchaai.com/res.php", params={
        "key": API_KEY,
        "action": "get",
        "id": task_id,
        "json": 1,
    }).json()

    if result.get("status") == 1:
        token = result["request"]
        print(f"Challenge solved! Token: {token[:50]}...")
        break
    elif result.get("request") == "ERROR_CAPTCHA_UNSOLVABLE":
        print("Challenge could not be solved")
        break
else:
    print("Timed out waiting for solution")

# Step 3: Use qa_validation_cookie cookie or token
# The response contains the clearance data needed to access the site

Metode 2: Otomatisasi Browser dengan CaptchaAI

Untuk sesi persisten, gabungkan headless browser dengan CaptchaAI:

from selenium import webdriver
from selenium.webdriver.support.ui import WebDriverWait
from selenium.webdriver.support import expected_conditions as EC
import requests
import time

API_KEY = "YOUR_API_KEY"

# Launch browser
options = webdriver.ChromeOptions()
driver = webdriver.Chrome(options=options)

# Navigate to IUAM page
driver.get("https://iuam-protected-site.com")

# Wait for challenge page to load
time.sleep(3)

# Check if IUAM challenge is present
if "Checking your browser" in driver.page_source or driver.title == "Just a moment...":
    print("IUAM challenge detected")

    # Option A: Wait for browser to solve natively (if not headless)
    try:
        WebDriverWait(driver, 15).until(
            lambda d: "Checking your browser" not in d.page_source
        )
        print("Challenge passed natively")
    except:
        print("Native solve failed — using CaptchaAI")
        # Submit to CaptchaAI for solving
        # Token submission via JavaScript injection

# After challenge is passed, extract cookies for API use
cookies = driver.get_cookies()
qa_validation_cookie = next(
    (c["value"] for c in cookies if c["name"] == "qa_validation_cookie"), None
)

if qa_validation_cookie:
    print(f"qa_validation_cookie obtained: {qa_validation_cookie[:30]}...")

    # Use cookie with requests library
    session = requests.Session()
    for cookie in cookies:
        session.cookies.set(cookie["name"], cookie["value"])
    session.headers.update({
        "User-Agent": driver.execute_script("return navigator.userAgent"),
    })

    # Now make requests with the clearance cookie
    response = session.get("https://iuam-protected-site.com/api/data")
    print(f"Status: {response.status_code}")

driver.quit()

Node.js

const axios = require("axios");

const API_KEY = "YOUR_API_KEY";
const TARGET_URL = "https://iuam-protected-site.com/data";

async function solveIUAM() {
  // Submit challenge
  const submit = await axios.post("https://ocr.captchaai.com/in.php", null, {
    params: {
      key: API_KEY,
      method: "cloudflare_challenge",
      sitekey: "managed",
      pageurl: TARGET_URL,
      json: 1,
    },
  });

  const taskId = submit.data.request;
  console.log(`Task submitted: ${taskId}`);

  // Poll for result
  for (let i = 0; i < 60; i++) {
    await new Promise((r) => setTimeout(r, 5000));

    const result = await axios.get("https://ocr.captchaai.com/res.php", {
      params: { key: API_KEY, action: "get", id: taskId, json: 1 },
    });

    if (result.data.status === 1) {
      console.log("IUAM challenge solved!");
      return result.data.request;
    }
  }

  throw new Error("Timed out");
}

solveIUAM().then((token) => console.log("Token:", token.substring(0, 50)));

Mengelola Cookie qa_validation_cookie

Cookie qa_validation_cookie adalah hasil utama dari solve IUAM challenge:

Strategi Manajemen Cookie

import requests
import time

class IUAMSessionManager:
    """Manage qa_validation_cookie cookies for IUAM-protected sites."""

    def __init__(self, api_key, target_url, user_agent=None):
        self.api_key = api_key
        self.target_url = target_url
        self.user_agent = user_agent or (
            "Mozilla/5.0 (Windows NT 10.0; Win64; x64) "
            "AppleWebKit/537.36 Chrome/120.0.0.0"
        )
        self.session = requests.Session()
        self.session.headers["User-Agent"] = self.user_agent
        self.clearance_time = 0
        self.clearance_lifetime = 1800  # 30 minutes default

    def needs_refresh(self):
        """Check if clearance cookie needs refreshing."""
        return time.time() - self.clearance_time > self.clearance_lifetime - 60

    def solve_challenge(self):
        """Solve IUAM challenge and update session cookies."""
        submit = requests.post("https://ocr.captchaai.com/in.php", data={
            "key": self.api_key,
            "method": "cloudflare_challenge",
            "sitekey": "managed",
            "pageurl": self.target_url,
            "json": 1,
        })

        task_id = submit.json()["request"]

        for _ in range(60):
            time.sleep(5)
            result = requests.get("https://ocr.captchaai.com/res.php", params={
                "key": self.api_key,
                "action": "get",
                "id": task_id,
                "json": 1,
            }).json()

            if result.get("status") == 1:
                # Apply clearance to session
                self.clearance_time = time.time()
                return result["request"]

        raise TimeoutError("IUAM solve timed out")

    def get(self, url, **kwargs):
        """Make a GET request, solving IUAM if needed."""
        if self.needs_refresh():
            self.solve_challenge()
        return self.session.get(url, **kwargs)

Pemecahan Masalah

Pertanyaan yang sering diajukan

Berapa lama qa_validation_cookie bertahan?

Standarnya 30 menit, tetapi operator situs dapat mengonfigurasinya dari 15 menit hingga 24 jam. Sebagian besar situs menggunakan waktu default 30 menit. Rencanakan untuk refresh sebelum kedaluwarsa.

Bisakah saya membagikan qa_validation_cookie antar request?

Ya, tapi hanya dari alamat IP yang sama dan dengan string User-Agent yang sama. Mengubah keduanya akan membuat cookie tidak valid.

Apakah Under Attack Mode selalu diaktifkan?

Tidak. Operator situs mengaktifkannya secara manual saat serangan. Beberapa situs membiarkannya aktif permanen sebagai lapisan keamanan tambahan. Tidak ada cara untuk memprediksi apakah suatu situs akan memiliki IUAM aktif.

Apa perbedaan antara IUAM dan Managed Challenge?

IUAM challenge setiap pengunjung tanpa syarat. Managed Challenge menggunakan penilaian bot Cloudflare untuk secara selektif challenge traffic yang mencurigakan. IUAM selalu mengembalikan 503 dengan JS challenge. Managed Challenge mungkin menampilkan 503 dengan widget Turnstile.

Apakah IUAM memengaruhi endpoint API?

Ya. IUAM berlaku untuk setiap request pada domain, termasuk endpoint API. Inilah sebabnya request API dari klien non-browser gagal — mereka tidak dapat mengeksekusi JavaScript challenge.

Ringkasan

Cloudflare Under Attack Mode membuat JavaScript challenge wajib bagi semua pengunjung, mengembalikan HTTP 503 dengan komputasi 5 detik. Solve IUAM challenge dengan Cloudflare Challenge Solver CaptchaAI, lalu gunakan cookie qa_validation_cookie untuk request berikutnya dalam 30 menit. Selalu cocokkan alamat IP dan User-Agent antara solve dan penggunaan.

Artikel Terkait

• Cloudflare Challenge vs Turnstile: Cara Mendeteksi
• Cloudflare Challenge: Parameter Halaman dan Alur Token
• Panduan Cookie qa_validation_cookie Cloudflare Challenge