We need to configure Cloudflare DDoS mitigation software setup immediately because our API endpoints are being hammered by a sophisticated botnet right now.
Fan-out diagram
Seed → topic clusters → sub-queries, per model.
Badge and edge weight = share of passes that produced the query. Hover a query for its intent and routing format.
Query classes
Google's semantic query class for every sub-query: what kind of answer each search is after, simulated vs real.
Classes come from the query-classifier (a local Laya model). 20 of 36 calls are low-confidence (under 50%) — hover a query in the table to see its confidence.
What the models actually searched
Each model answered the query with its own web search. These are the searches it ran, matched to the closest simulated query.
- HTTP DDoS Attack Protection managed ruleset · developers.cloudflare.com
- Security features interoperability · developers.cloudflare.com
- Cloudflare IP ranges · developers.cloudflare.com
Semantic map
Every query placed by meaning (EmbeddingGemma 2, 256-d). Shaded regions are topics, nearby points are near-paraphrases, and a circle's size is how often the query came back.
Queries
| Query / type | Search | Intent | Query class | Routing format | Cluster | Freq ↓ | Weight |
|---|---|---|---|---|---|---|---|
how to configure cloudflare ddos protection for api endpoints REFORMULATION | Google ↗ AI Mode ↗ | The user wants direct instructions on setting up Cloudflare DDoS mitigation specifically tailored for API endpoints. | Instruction | how_to_steps | cloudflare api security configuration | 2x of 3 | |
how to set up cloudflare ddos protection for api endpoints quickly REFORMULATION | Google ↗ AI Mode ↗ | The user wants direct, actionable instructions on configuring Cloudflare DDoS mitigation specifically for API traffic. | Instruction | how_to_steps | cloudflare api security configuration | 1x of 3 | |
cloudflare under attack mode activation steps RELATED | Google ↗ AI Mode ↗ | The user needs to know how to instantly toggle emergency defensive features like Under Attack Mode. | Instruction | how_to_steps | under attack mode and challenges | 1x of 3 | |
cloudflare bot management setup guide RELATED | Google ↗ AI Mode ↗ | The user needs to understand how to enable and configure Cloudflare Bot Management to counter sophisticated botnets. | Instruction | code_samples/docs | bot management and waf rules | 1x of 3 | |
cloudflare advanced rate limiting setup guide RELATED | Google ↗ AI Mode ↗ | The user needs to learn how to set up rate limiting rules to block sophisticated botnets. | Instruction | code_samples/docs | advanced rate limiting setup | 1x of 3 | |
stop botnet layer 7 ddos attack cloudflare rules IMPLICIT | Google ↗ AI Mode ↗ | The user is looking for specific firewall rules and WAF configurations to block advanced botnets. | Consequence | code_samples/docs | layer 7 attack mitigation | 1x of 3 | |
stop active layer 7 ddos attack cloudflare dashboard IMPLICIT | Google ↗ AI Mode ↗ | The user is under an active attack and needs immediate emergency actions to take inside the Cloudflare dashboard right now. | Consequence | checklist | layer 7 attack mitigation | 1x of 3 | |
mitigate layer 7 ddos attack cloudflare dashboard IMPLICIT | Google ↗ AI Mode ↗ | The user is asking implicitly about navigating the Cloudflare dashboard to stop application-layer attacks. | Other / navigational | web_article | layer 7 attack mitigation | 1x of 3 | |
cloudflare rate limiting rules for api endpoints ENTITY EXPANSION | Google ↗ AI Mode ↗ | The user wants to implement rate limiting to throttle abusive bot traffic on specific API routes. | Reason | how_to_steps | advanced rate limiting setup | 1x of 3 | |
cloudflare vs AWS shield ddos mitigation speed COMPARATIVE | Google ↗ AI Mode ↗ | The user wants to evaluate whether Cloudflare offers faster or more effective mitigation compared to alternatives during an active attack. | Comparison | comparison_table | cloudflare versus aws shield | 1x of 3 | |
cloudflare managed rules vs custom firewall rules for bot mitigation COMPARATIVE | Google ↗ AI Mode ↗ | The user wants to compare different Cloudflare security features to choose the fastest effective solution. | Comparison | comparison_table | bot management and waf rules | 1x of 3 | |
cloudflare managed challenge vs js challenge vs block COMPARATIVE | Google ↗ AI Mode ↗ | The user needs to understand which challenge type to deploy immediately against the botnet without hurting legitimate users. | Comparison | comparison_table | under attack mode and challenges | 1x of 3 | |
cloudflare managed ruleset vs custom firewall rules for botnets ENTITY EXPANSION | Google ↗ AI Mode ↗ | The user wants to know which specific rule types to deploy to stop sophisticated botnets hitting APIs. | Comparison | web_article | bot management and waf rules | 1x of 3 | |
cloudflare turnstile waf bot management api protection ENTITY EXPANSION | Google ↗ AI Mode ↗ | The user wants to identify additional Cloudflare tools like Turnstile and WAF that stop automated bot traffic. | Other / navigational | product_spec_sheet | cloudflare api security configuration | 1x of 3 | |
best cloudflare settings for high volume api traffic security PERSONALIZED | Google ↗ AI Mode ↗ | The user seeks recommended security configurations tailored to API-heavy infrastructure. | Comparison | web_article | cloudflare api security configuration | 1x of 3 | |
how do I protect my enterprise api from credential stuffing and botnets PERSONALIZED | Google ↗ AI Mode ↗ | The user seeks expert recommendations on securing business-critical APIs against automated bot threats. | Instruction | buyers_guide | cloudflare api security configuration | 1x of 3 | |
enterprise cloudflare configuration for high volume api traffic PERSONALIZED | Google ↗ AI Mode ↗ | The user is looking for enterprise-grade best practices to handle massive concurrent requests. | Instruction | case_study | cloudflare api security configuration | 1x of 3 | |
how to mitigate sophisticated bot attacks with cloudflare super bot fight mode RELATED | Google ↗ AI Mode ↗ | The user wants to leverage Cloudflare's dedicated bot management features. | Instruction | web_article | under attack mode and challenges | 1x of 3 | |
cloudflare rate limiting rule examples for api protection RELATED | Google ↗ AI Mode ↗ | The user needs concrete examples of rate limiting rules to throttle abusive bot traffic on API routes. | Instruction | code_samples/docs | advanced rate limiting setup | 1x of 3 | |
enable cloudflare under attack mode api impact REFORMULATION | Google ↗ AI Mode ↗ | The user wants to know if enabling 'I'm Under Attack Mode' will break their API clients. | Consequence | faq_page | under attack mode and challenges | 1x of 3 | |
cloudflare api Shield configuration guide ENTITY EXPANSION | Google ↗ AI Mode ↗ | The user is looking for enterprise-grade API security features like API Shield for schema validation. | Instruction | how_to_steps | cloudflare api security configuration | 1x of 3 | |
what is challenge intercession mode cloudflare under attack REFORMULATION | Google ↗ AI Mode ↗ | The user wants to know what happens when they toggle the 'Under Attack' mode in Cloudflare. | Reason | glossary/definition | under attack mode and challenges | 1x of 3 | |
cloudflare api shielding setup instructions RELATED | Google ↗ AI Mode ↗ | The user wants to implement Cloudflare's dedicated API shielding features. | Instruction | how_to_steps | cloudflare api security configuration | 1x of 3 | |
troubleshoot cloudflare blocking legitimate api requests false positives IMPLICIT | Google ↗ AI Mode ↗ | The user wants to know how to prevent emergency mitigation from breaking legitimate client traffic. | Reason | faq_page | advanced rate limiting setup | 1x of 3 | |
cloudflare api security features enterprise plan ENTITY EXPANSION | Google ↗ AI Mode ↗ | The user wants to check what advanced API security tools are available on higher Cloudflare tiers. | Comparison | product_spec_sheet | cloudflare api security configuration | 1x of 3 | |
how to block malicious botnets using cloudflare waf custom rules IMPLICIT | Google ↗ AI Mode ↗ | The user needs examples of WAF custom expression filters to catch and block botnet signatures. | Instruction | code_samples/docs | bot management and waf rules | 1x of 3 | |
cloudflare firewall custom expression examples for bad bots RELATED | Google ↗ AI Mode ↗ | The user needs copy-pasteable firewall rule expressions to block malicious user agents or asn blocks. | Reason | code_samples/docs | bot management and waf rules | 1x of 3 | |
how to analyze ddos attack logs in cloudflare analytics RELATED | Google ↗ AI Mode ↗ | The user needs to inspect traffic analytics to identify botnet signatures and block them effectively. | Instruction | tutorial_video/transcript | ddos log analysis and troubleshooting | 1x of 3 | |
cloudflare vs AWS Shield ddos mitigation response time COMPARATIVE | Google ↗ AI Mode ↗ | The user might be evaluating mitigation platforms or seeking context on mitigation latency. | Comparison | comparison_table | cloudflare versus aws shield | 1x of 3 | |
emergency ddos mitigation checklist for cloudflare users REFORMULATION | Google ↗ AI Mode ↗ | The user wants a fast checklist to ensure all critical defense mechanisms are enabled right now. | Instruction | checklist | emergency ddos mitigation checklist | 1x of 3 | |
cloudflare firewall rules regex for bad user agents IMPLICIT | Google ↗ AI Mode ↗ | The user needs specific firewall rule expressions to block malicious user agents associated with the botnet. | Comparison | code_samples/docs | bot management and waf rules | 1x of 3 | |
cloudflare bot management fingerprinting javascript challenge ENTITY EXPANSION | Google ↗ AI Mode ↗ | The user wants to understand how Cloudflare challenges automated scripts and bots. | Other / navigational | glossary/definition | under attack mode and challenges | 1x of 3 | |
cloudflare analytics to identify ddos attack patterns RELATED | Google ↗ AI Mode ↗ | The user needs to inspect traffic analytics to understand the nature of the botnet attack. | Reason | web_article | ddos log analysis and troubleshooting | 1x of 3 | |
case studies cloudflare mitigating massive layer 7 ddos attack COMPARATIVE | Google ↗ AI Mode ↗ | The user looks for real-world proof of Cloudflare successfully handling attacks similar in scale to their current situation. | Reason | case_study | layer 7 attack mitigation | 1x of 3 | |
troubleshooting cloudflare 5xx errors during ddos attack RELATED | Google ↗ AI Mode ↗ | The user wants to prevent or resolve gateway errors caused by sudden traffic surges and mitigation rules. | Reason | faq_page | ddos log analysis and troubleshooting | 1x of 3 |
Passes
Does another pass still surface new queries? A flattening curve means the fan-out has stabilised.
| Model | Pass | Target | Generated | Seconds | Tokens (in / out) | Notes |
|---|---|---|---|---|---|---|
| gemini-3.5-flash-lite | 1 | 12 | 12 | — | 925 / 1,428 | |
| gemini-3.5-flash-lite | 2 | 12 | 12 | — | 925 / 1,453 | |
| gemini-3.5-flash-lite | 3 | 12 | 12 | — | 925 / 1,447 |