11–20 of 28 posts
Since it hasn't been mentioned, my first thought is valid users browsing on iOS with iCloud Private Relay enabled. https://support.apple.com/en-us/102602 I have this enabled on my iPhone and websites that report my IP show the block is owned by Cloudflare or Akamai.
Then block the ip/asn/service that’s causing the bot traffic if you deem useless.
Some bots can be related to SEO tools, these will have Search Engine Optimization category in CloudFlare
173.245.58.0 is owned by cloudflare ( https://www.cloudflare.com/ips/ ). You're probably tracking the IP address of cloudflare's reverse proxy that hits your application instead of true source IP (which cloudflare will copy into X-Forwarded-For header). Likely you pulled this IP from your application's logs? If you're trying to track bot traffic, use Cloudflare's built-in analytics tool. Also a single source IP can b…
I don’t think I’ve seen a similar case for anycast egress. Naively, doesn’t seem like it would work well because a lot of the internet (eg non-anycast geographic load balancing) relies on unique sources, and Cloudflare definitely break out their other anycast addresses (eg they don’t send outbound DNS requests from 1.1.1.1).
173.245.58.0 is owned by cloudflare ( https://www.cloudflare.com/ips/ ). You're probably tracking the IP address of cloudflare's reverse proxy that hits your application instead of true source IP (which cloudflare will copy into X-Forwarded-For header). Likely you pulled this IP from your application's logs? If you're trying to track bot traffic, use Cloudflare's built-in analytics tool. Also a single source IP can b…
It’s possible, but I think it’s typically used for ingress (ie same IP, but multiple destinations, follow BGP to closest one). I don’t think I’ve seen a similar case for anycast egress. Naively, doesn’t seem like it would work well because a lot of the internet (eg non-anycast geographic load balancing) relies on unique sources, and Cloudflare definitely break out their other anycast addresses (eg they don’t send out…
Earlier quoted context omitted.
It’s possible, but I think it’s typically used for ingress (ie same IP, but multiple destinations, follow BGP to closest one). I don’t think I’ve seen a similar case for anycast egress. Naively, doesn’t seem like it would work well because a lot of the internet (eg non-anycast geographic load balancing) relies on unique sources, and Cloudflare definitely break out their other anycast addresses (eg they don’t send out…
Cloudflare actually does anycast for egress too, if that is what you meant: https://blog.cloudflare.com/cloudflare-servers-dont-own-ips-...
I wasn’t precise, but what I meant was more akin to a single IP shared by multiple datacenters in different regions (from a BGP perspective), which I don’t think Cloudflare has. This is general parallel of ingress unicast as well, a single IP that can be routed to multiple destinations (even if on the BGP level, the entire aggregate is anycast).
It would also not explain the OP, because they are seeing the same source IP, but from many (presumably) different source locations whereas with the Cloudflare scheme each location would have a different source IP.
So, hopefully you are able to check on which header your requests are being hit with.
Other comments already mentioned it, but that’s to figure out with your anti-ddos/reverse proxy headers setup
Earlier quoted context omitted.
Cloudflare actually does anycast for egress too, if that is what you meant: https://blog.cloudflare.com/cloudflare-servers-dont-own-ips-...
So reading the article you’re right, it’s technically anycast. But only at the /24 level to work around BGP limitations. An individual /32 has a specific datacenter (so basically unicast). In a hypothetical world where BGP could route /32s it wouldn’t be anycast. I wasn’t precise, but what I meant was more akin to a single IP shared by multiple datacenters in different regions (from a BGP perspective), which I don’t…
> hundreds of requests per day Does this matter? I can handle hundreds of requests per day with no issue on a home cable modem connection and my desktop pc running nginx. In fact I do and have since the 56k days. With an actual server or VPS with a big pipe in a datacenter this should literally be below noticing in terms of cost. I would characterize this response to normal public website traffic as more harmful than…
And what kind of ecommerce site are you running on that nginx? First thing that get overwhelmed by bot traffic is DB. With a tiny one, with low total connection limit and bots hitting less common path like browsing 20th page of product search results, it is really easy to get DoS. I remember having to block Yandex user agent 20 years ago, surprising no one wanted to allocate additional resources so that crawler is happy.
Earlier quoted context omitted.
So reading the article you’re right, it’s technically anycast. But only at the /24 level to work around BGP limitations. An individual /32 has a specific datacenter (so basically unicast). In a hypothetical world where BGP could route /32s it wouldn’t be anycast. I wasn’t precise, but what I meant was more akin to a single IP shared by multiple datacenters in different regions (from a BGP perspective), which I don’t…
To my knowledge, any cast is very much a thing cloudflare uses.. It allows to split traffic per region, which, in the case of DDOS is a good thing.
Since you mentioned DDOS, I’m assuming you are talking about ingress anycast?