Our server is in DDOS attack, and many ips is from Cloudflare WARP, ex: 2a09:bac5:55f2:1028::19c:5f. Attacker use large amount of ips, and change it very often. We applied rate limit based on client's ip, but it didn't work as expect. How could we determine client's identify (ip or some other infomation) hidden behind Cloudflare WARP.
P/s: Our site is using Cloudflare DNS service.
I searched on Cloudflare but seem they complete hidden client's real IP as new policy.