Activity from one IP

Hello, I have 18GB of probing activity for the last 10 hours from an IP in Canada, I am sure i am blocking them but the activity is ongoing.

Screenshots in a tweet here https://twitter.com/FearbySoftware/status/1167255370655510528

Is there anything else I can do to bounce this IP and not receive their traffic

That looks to be iweb dot com, and belongs to a very small address range.

You’re already blocking them at Cloudflare. Isn’t that enough?

I would have thought a block at Cloudflare would also block the traffic. I can see cached and uncached in in a graph but not blocked data. Why would someone still hit cloudflare with 18GB of data for 10 hours?

I am wondering if the firewall is working?

I suspect the Cloudflare firewall is not working as they doubled the scan rate and I have had 134,000 probes in 24 hours. I was able to re block the ip (strangely it said it was not a duplicate record)

Well, that particular IP appears to get blocked. So the traffic must come from somewhere else. Check your server logs.

1 Like

right

This topic was automatically closed after 14 days. New replies are no longer allowed.