Hello, I’m seeing a strange pattern in my logs where a Googlebot IP address, but also a Cloudflare IP address for workers (2a06:98c0:3600::103) triggers a ModSec rule. I would like to understand it, and resolve it if possible because this pattern is occuring approximately 600 times per day. It goe…

CF worker IP 2a06:98c0:3600::103 with Googlebot triggering ModSec rule

rockbrookcamp June 16, 2023, 4:10pm 18

With the help of Cloudflare support, the issue has been tied to Automatic Signed Exchanges (SXGs) feature. Working now on a possible explanation and (ideally) workaround.

4 Likes

How can I block 2a06:98c0:3600::103 at WAF level

Topic		Replies	Views
Suspicious Googlebot-like requests from 2a06:98c0:3600::103 Security	2	1753	July 13, 2022
Bug with WAF Logs; Same IP address shown for different ASNs Security	8	2016	July 30, 2022
CF worker abuse Security	2	2014	April 3, 2022
Frequent Visits from "CloudflareDiagnostics" Security	2	2705	January 18, 2020
The 'Workers' feature makes CF's protection useless Security	2	1416	July 27, 2022

CF worker IP 2a06:98c0:3600::103 with Googlebot triggering ModSec rule

Related Topics