[lgats]

cloudflare firewall rule that I think will help protect against this:

   (not http.request.uri.path contains "." and any(http.request.headers["content-range"][*] contains "bytes"))

my dynamic pages shouldn't contain any . (extension) so if a request contains content-range: bytes*, we challenge the request.

you may have to modify for your needs