CF worker abuse

Security
#1

Hey all,

Yes its time to moan about 2a06:98c0:3600::103 Cloudflare ip address which i believe is cf workers. Now rules around no useragent i block 10s of thousands requests per day from this i.p that come from google asn odly enough.

I seen a few threads with no aolid answer if its google legit, or some scraper on google services. I notice this action is only getting inages only, nothing else.

Anyone know if this is legit recently, i just find it odd a scraper be only getting images most grab everything mostly and the amount too isnt normal which makes me think it maybe legit hmmm.

Was thinking of making a ticket, but thought about asking here first.

#2

https://developers.cloudflare.com/workers/runtime-apis/headers/#request-header
https://developers.cloudflare.com/ruleset-engine/rules-language/fields/#:~:text=cf.tls_client_auth.cert_revoked).-,cf.worker.upstream_zone,-String

I believe people are using workers in a way you might find malicious; you can create a firewall rule that blocks requests coming from workers.

#3

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.