Using Generative AI to Reverse-Engineer Botnet Attacks
In a DDoS attack, the security logs can grow too fast for a mere mortal to identify the emerging traffic patterns. I use this specific prompt structure to get Gemini busy at doing the technical analysis. This includes identifying bot clusters, emerging threats, and inadvertent “friendly fire” incidents. Such analysis is the key to staying a step ahead of probing and the evolving attacks.
I’ve built the prompt structure over months of daily use on multiple Cloudfalre accounts on “free” plans. There are several important elements to an effective prompt, as follows:
- The Team: the Gemini persona required to do the analysis and provide the best possible solutions. Explain who you are, and what your role is.
- The Subject: Analysis of Cloudflare security rules log files for [www.yourdomain.co.nz]
- The Constants: The more explicit you are, the less guesswork is required by the AI and the fewer the mistakes that will be made.
- Known Issues: Are you aware of any potential issues with hosting, or the WordPress installation? Has any transaction failed, or contact form stopped sending, or backups failed etc.
- The Data: How many files will you upload? The maximum is 10 at one time – you are limited to 5 Security Rules on a Free plan, plus one Rate Limiting rule so there should usually be no problems there.
- The Instructions: Being explicit reduces errors. Spell it out carefully. Whatever you do, don’t get off-topic! If the AI asks “Would you like me to also do X, Y, and Z?” – don’t feel obliged to respond! In my experience, the AI “hallucinations” become a bigger problem the more times you use the same chat, and even faster if you introduce or respond to vaguely related questions.
Constants:
By including “CONSTANTS” such as your Internet Service Provider’s ASN number, your hosting server’s IP Address, you help ensure that normal website access and processes continue without being impeded by security blocks or managed challenges. Not locking yourself out should be the first priority. Allowing backups, caching and sales to proceed without issue are also important.
Instructions:
AI is, as I’m sure you know, short for artificial intelligence. What you need to be aware of is that the “intelligence” accolade is more than a little generous. What you must understand is that there’s zero intellectual component at play. It is incredibly good at giving the answer to very complex questions IF someone else has previously documented solutions to the problem you have.
Generative AI Limitations
If you have a unique problem that may not have been documented explicitly, AI will guess… It won’t ever say: “I dunno mate, I wouldn’t have a clue!” It will give you a convincing explanation and persuade you to do something… possibly something stupid. Sometimes the guesses are damned good… Sometimes, not so much, and it will sometimes break things you’ve already fixed while flailing around trying to pull a rabbit out of the hat for you. What it won’t do is figure out a NEW and imaginative solution to whatever the at-hand problem is. Which is sometimes bloody annoying!
Example: WooCommerce Subscription Renewals:
These are complicated, and trigger a flurry of activities that can trigger a generously set Rate Limiting rule. They do a series of Posts, and that can be a followed by a lengthy pause while the payment module processes the purchase. If Stripe is involved, it Posts the receipt back to your webhook. Our Rule #1 “Admin Team Access:” ensures passage for WP Rocket Caching, Updraftplus Backups, ManageWP, Wordfence etc and the initial Renewal processes, which were able to “Skip” all remaining rules.
Sadly, the “payment received Post” that comes back from Stripe was often getting “Blocked” by the Rule #4 “Universal Post Bomb” because its format was similar enough to be matched to a malicious event. The AI kept giving me new iterations of Rule #1 with convincing explanations of why this next version would work. We did have instances where it did work for several consecutive transactions. And then it would stop again for no obvious reason…
One night I woke up at some ungodly hour with the thought that; “This is bloody stupid – rather than keep trying to get all the lightning into the bottle with one rule, it would make more sense to take the win on the transaction initiation!” Then add a Stripe-specific rule as the next step, catching the delayed “payment received Post” and allowing it to “SKIP” all other rules…”
The AI comprehended the logic in that and crafted the new Rule #2. That worked a treat – but it illustrates quite well what the AI cannot do – simply because it has no imagination… yet.
Your ‘free’ Cloudflare Security Rules
In another tutorial page on Cloudflare ‘free’ Security Rules Guide for WordPress, I explained how to develop your own set of custom security rules. Assuming you’ve done that step already, This page explains how to analyse the security rules log files…
Basically, we’re going to use a similar Prompt to that explained in the guide. You can add in your current (live) Security Rules “Expressions” into the prompt structure… or switch over to the Rules Structure I’ve provided. Then, you will:
- Download your 5 security rule event log files to your device.
- Upload your Cloudflare firewall logs into the Gemini input panel
- Then paste in the Prompt that explains what you want done.
Configuration Lists: Free Plan limit is 1
You should already have created your Listsin Cloudflare | Manage Account | Configuration
(Cloudflare Dashboard > Account Home > Configurations > Lists)
Payment Modules: Stripe:
The chances are high that if you have a Cart, you’ve got Stripe payments running. Create a List for the IP Address ranges.
Name: $stripe_webhooks
Includes these 4 ranges in your Stripe IP List:
3.18.12.32/28
3.130.192.160/27
35.154.166.0/28
52.15.183.38
Maintenance Notice: From time to time, Stripe will update their Webhook IP Address ranges. The 4 ranges I’ve provided are current as of April 2026. If payments stop getting through to your Woocommerce site, please search online for the latest IP address range for Stripe. Because we’re using a Cloudflare IP List ($stripe_webhooks), you will only need to update the List in your Cloudflare dashboard Configuration settings: you won’t need to manually edit every one of your security rules!
The Generative AI Prompt to Reverse-Engineer Botnet Attacks
For this to work, copy or download it and open it in Notepad.
Edit and fill in all the elements in [brackets]
SECTION ONE: Getting the rules sorted out.
TO: Gemini
Your Role: You are a Cloudflare cybersecurity consultant with extensive experience in WordPress security.
From: [your name]
My Role: [webmaster, owner, tech support] (delete N/A)
Subject: Security Rules for: [yourdomainname.co.nz]
Explanation: This STAGE ONE of the process is about replacing any old DIY Security Rules by adding in all the data you have previously gathered. Then, transforming the sample rules below to include your data before deplying them live on your Cloudflare account. The emphasis on Rule #1: Admin Team Access, and Rule #2: The Priority Bypass is to:
- prevent you from inadvertently locking yourself out of your website
- prevent legitimate website processes from failing due to security rules blocking them.
CONSTANTS:
Constant #1. Server IP Address: [IP address]
Constant #2. Owner IP Address: [IP address]
Constant #3. Owner ISP Name: [IP address]
Constant #4. Cloudflare: [FREE plan]
Constant #5. Technical Support: if you have a website maintenenace plan
Constant #6. Business Head Office: [NZ]
Constant #7. Customers In: [NZ]
Constant #8. Website: www.yourdomainname.co.nz
Constant #9. Platform: WordPress
Constant #10. Woocommerce: [NO] IF Constant #10 is NO, any high-frequency POST requests to the root directory or wp-login.php from non-NZ/AU ASNs should be immediately added to Rule #4.
Constant #11. Caching: [WP Rocket Cache, Super Page Cache, Asset Cleanup to deactivate XML RPC] (Delete N/A)
Constant #12. Cloudflare Security Rules: [To be Applied/already applied] (delete N/A)
- Rule #1 Admin Team Access: ensure passage for WP Rocket Caching, Updraftplus Backups, ManageWP, Wordfence etc.
- Rule #2 The Priority Bypass (Allow Rule)
- Rule #3 Master Directory & Cart Shield
- Rule #4 Universal Post Bomb
- Rule #5 Managed Challenge (The Low-Friction Filter)
Constant #13. Cloudflare Cache Rules: [To be Applied/already applied] (delete N/A)
Constant #14. Backups: [Updraftplus]
Constant #15: Regional ISP Protection Policy
Mandatory Logic: NEVER suggest a BLOCK action for ASNs identifying as major AU/NZ Residential/Mobile providers.
Approved Action: If high-volume threats originate from these ASNs, the AI must escalate them to Rule #5 (Managed Challenge) only.
Protected ASNs:
- NZ: 4771, 2570 (Spark), 9500, 45179, 4768, 34738, 17435 (One NZ), 9790, 23655, 38793 (2degrees), 55454 (Vocus/Orcon).
- AU: 1221, 135887 (Telstra), 7474, 18191 (Optus), 7545, 4802, 4739 (TPG/iiNet), 4764 (Aussie BB).
Constant #16: Stripe Webhooks
Use the Cloudflare IP List ID: $stripe_webhooks for all payment-related bypasses.
Name: $stripe_webhooks
It includes these 4 ranges in our Stripe IP List:
3.18.12.32/28
3.130.192.160/27
35.154.166.0/28
52.15.183.38
Constant #17 Security installed: [Wordfence Security, Sucuri, BBQ, Loginizer] (delete N/A)
Constant #18: WordPress Address (URL): [domain name plus subdirectory, if used]
Constant #19: Site Address (URL): [usually, just your domain name]
---------------------------------------------------------
Known Issues: do you have problems or issues to report? Backups not working, Wordfence scans not completing, cron jobs not running?
The Objectives:
- to validate that your current security rules have all the information in the right places.
- to process the log file data generated by the security rules, analyse and reverse-engineer it.
- to update your Security Rules to combat new or evolving attacks patterns.
The Data: I am uploading [?] security log files on [todays date]
Instructions:
STAGE ONE:
Step 1: Whitelist:
From the constants above for server IP, Owner IP, accumulate the list of approved IP Addresses and find their ASN numbers.
Prepare to replace the text string ip.src in {admin IP Addresses} in the initial rules with the correct IP Address list.
Prepare to replace the text string ip.src.asnum in {approved ASN numbers} in the initial rules with the correct ASN numbers.
Step 2: Security Rules
1. Please review the 5 Security Rules below.
Context: "Reference Constants #1 - #16."
Analysis: "Scan logs for anomalies (High 404s, POST spikes, Bot-like User Agents)."
Drafting: "Update Rule (Expression). Retain all existing lines."
Validation: "Cross-reference against Constant #15 and Constant #16 before finalizing."
2. For each rule, ensure the admin IPs are whitelisted and {approved ASN numbers} are implemented where appropriate..
3. For each rule, ensure the correct domain name is used.
4. Look for and repair any syntax errors.
5. http.request.uri.path: Don't DROP any "http.request.uri.path" listed. These are under attack on multiple NZ websites.
6. http.user_agent: Don't DROP any "http.user_agent" listed. I know this application needs protection to function.
7. Look for the 'Top 10 most frequent blocked IPs' and suggest if they should be included in Rule #3 or Rule #4 (Block).
8. Where revision is needed, provide the FULL updated expression for the Rule
---------------------------------------
Rule #1 Admin Team Access for Backups, Caching etc
When incoming requests match…
<code>
(
(
http.request.uri.path contains "admin-ajax.php" or
http.request.uri.path contains "/wp-admin/" or
http.request.uri.path contains "/wp-json/" or
http.request.uri.path eq "/wp-cron.php"
)
and
(
ip.src in {admin IP Addresses} or
ip.src.asnum in {approved ASN numbers} or
http.user_agent contains "WP-Rocket"
)
)
</code>
SKIP
Log matching Requests
------------------------------------------------
Rule #2 The Priority Bypass (Allow Rule)
When incoming requests match…
<code>
(
http.host eq "www.yourdomainname.co.nz"
and (
ip.src.country in {"NZ" "AU"}
or cf.client.bot
or ip.src in {admin IP Addresses}
or ip.src in $stripe_webhooks
or ip.src.asnum in {approved ASN numbers}
)
and (
http.request.uri.path contains "/wp-json/" or
http.request.uri.path contains "/wc-api/" or
http.request.uri.path contains "wp-cron.php" or
http.request.uri.path contains "admin-ajax.php" or
http.request.uri.path in {"/wp-login.php" "/xmlrpc.php"} or
http.request.uri.query contains "wc-api=" )
)
</code
SKIP
Log matching requests
WAF components to skip
- All remaining custom rules
- All rate limiting rules
- All managed rules
- All Super Bot Fight Mode Rules
More components to skip
- Zone Lockdown
- User Agent Blocking
- Browser Integrity Check
- Hotlink Protection
- Security Level
- Rate limiting rules (Previous version)
- Managed rules (Previous version)
------------------------------------------------
Rule #3 Master Directory & Cart Shield
When incoming requests match…
<code
(
not cf.client.bot
and not ip.src in {admin IP Addresses}
and not ip.src.asnum in {approved ASN numbers}
)
and (
(http.host eq "www.yourdomainname.co.nz" and not ip.src.country in {"NZ" "AU"})
or (ip.src.asnum in {13335 14061 8075 31898 51396 396982 40021 209605 201814 141995 213230 39642 394089 212238 60068 213438 215607 48090 51167 45090 33182 12876 9541 20473})
)
and (
http.request.uri.path contains "/wp-login.php"
or http.request.uri.path contains "/xmlrpc.php"
or http.request.uri.path contains "/alfacgiapi/"
or http.request.uri.path contains "/ALFA_DATA/"
or http.request.uri.path contains "/packages/"
or http.request.uri.path contains "ckupload.php"
or http.request.uri.path contains "ckeditor/upload.php"
or http.request.uri.path contains ".sql"
or http.request.uri.path contains ".env"
or http.user_agent contains "curl"
or http.request.uri.path contains "/cpanel"
or http.request.uri.path contains "/whm"
or http.request.uri.path contains "/webmail"
or http.host contains "cpanel."
or http.host contains "whm."
or http.host contains "webmail."
or http.request.uri.query contains "rest_route="
or http.request.uri.path contains "/.git/"
or http.request.uri.path contains "composer.json"
)
</code
Then take action…
BLOCK
------------------------------------------------
Rule #4 Universal Post Bomb
When incoming requests match…
<code
(http.request.method eq "POST")
and not (cf.client.bot or ip.src in {admin IP Addresses} or ip.src.asnum in {approved ASN numbers})
and (
(ip.src.asnum in {210558 26548 202412 45102 47583 39351 16276 16509 24940 31898 51396 14061 13335 396982 40021 8075 209605 201814 141995 213230 39642 394089 212238 60068 213438 396356 21859 211590 216071})
or (http.request.uri.path in {"/wp-comments-post.php" "/xmlrpc.php" "/wp-login.php"})
or (not http.referer contains "www.yourdomainname.co.nz" and not http.user_agent contains "WordPress")
or (len(http.user_agent) < 45)
or (cf.edge.server_port in {2082 2083 2086 2087 2095 2096})
)
</code
BLOCK
------------------------------------------------
Rule #5 Managed Challenge (The Low-Friction Filter)
When incoming requests match…
<code
(not ip.src.country in {"NZ" "AU"}) and not (cf.client.bot or ip.src in {admin IP Addresses} or ip.src.asnum in {approved ASN numbers})
</code
Managed Challenge
========================================================================================
STAGE TWO:
I have now completed the updating of the Security Rules in STAGE ONE
I have now uploaded [5] security rule event logs.
Please review the event logs and determine if the Security Rules would benefor from revision.
- If so, please provide the revised Expressions
Questions:
1. Does the data today indicate increased or decreased activity?
2. Can you identify what botnet is active on this website?
3. Can you deduce its most likely objective?
========================================================================================
WHAT'S NEXT?
Final Notes:
Having proceeded through:
STAGE ONE: implementing a full set of Security Rules in your Cloudflare account.
STAGE TWO: uploading a set of security rules event logs and having them analysed.
The ongoing process of monitoring security rules event logs won't nearly need so much detail.
Usually, only Rule #3: Master Directory & Cart Shield, and Rule #4: Universal Post Bomb, will need regular revision as attack profiles change.
Therefore, the PROMPT TWO can be much simpler and more focused.
---------------------------------------------------------
SECTION TWO: Ongoing reverse engineering of attacks.
PROMPT #2
TO: Gemini
From: [your name]
Subject: Security Rules for: [yourdomainname.co.nz]
---------------------------------------------------------
The Objectives:
- to process the log file data generated by the security rules, analyse and reverse-engineer it.
- to update the main Security Rules to combat new or evolving attacks patterns.
Security Rules
1. After analysing security event logs, please review the 2 Security Rules below: Rule #3 "Master Directory & Cart Shield" AND Rule #4 Universal Post Bomb
Context: "Reference Constants #1 - #16."
Analysis: "Scan security event log files for anomalies (High 404s, POST spikes, Bot-like User Agents)."
Drafting: "Update Rule (Expression). Retain all existing lines."
Validation: "Cross-reference against Constant #15 and Constant #16 before finalizing."
2. Where revision is needed, provide the FULL updated expression for the Rule
---------------------------------------
I have now uploaded [?] security rule event logs on [todays date].
Instructions:
Please review the event logs and determine if the Security Rules #3 and #4 would benefit from revision.
Only refer to data that is in this set of firewall logs that have just been uploaded.
Assess if:
- the rules are effectively stopping attacks on the Edge
- anything is not being stopped, and will need additional Security Rule coverage
- anything is inadvertently blocking our own internal administrative activities
1.) IF Rule #3 "Master Directory & Cart Shield" - Live Version:
IF it needs more inclusions to cover new threats: Retain the existing elements in the Rules, and:
THEN please rewrite the Expression below and send it through to me.
<code
******INSERT YOUR LIVE "EXPESSION CODE" HERE****
</code
------------------------------------------------
Rule #4 Universal Post Bomb - Live Version:
IF it needs more inclusions to cover new threats: Retain the existing elements in the Rules, and:
THEN please rewrite the Expression below and send it through to me.
<code
******INSERT YOUR LIVE "EXPESSION CODE" HERE****
<code>
========================================================================================
Questions:
1. Does the data today indicate increased or decreased activity?
2. Can you identify what botnet is active on this website?
3. Can you deduce its most likely objective?
“Download My Firewall Log Auditor Prompt”
Notes:
When using this prompt, upload your security logs as .json files.
Event Log Monitoring and Rules Maintenance:
Gemini will give you the updated “Expression” code for each Rule.
Insert that into the respective Security Rules in your Cloudflare account.
Depending on the urgency of the situation: daily, or once or twice a week, run through the Prompt Two process:
- download the latest event log files
- upload them to Gemini
- Insert Prompt Two and follow the suggestions.
Page last updated on Friday, June 19, 2026 by the author Ben Kemp
