Cloudlare ip 188.114.96.3 on SSL abuse list

Website, Application, Performance Security
1

What is the name of the domain?

multiple domains…

What is the issue you’re encountering

Cloudflare ip listed on SSL abuse list.

What is the current SSL/TLS setting?

Off

What are the steps to reproduce the issue?

If you use any proxy or similar using the SSL abuse list: https://opendbl.net/lists/sslblock.list.
I’m seeing multiple websites blocked by this.

2

Hi there,

Thank you for reaching out to us.

Cloudflare helps protect sites, and accelerate them. We do not attack sites, and our network can’t be used to generate attack traffic.

There are two circumstances where it might appear that Cloudflare is attacking your site.

  1. You’re a Cloudflare customer for your website(s). Since Cloudflare is a reverse proxy for our customers’ sites, Cloudflare IPs are going to show in your server logs until you install something on your server to restore original visitor IP, such as ngx_http_realip_module for NGINX servers.

Solutions for seeing original visitor IP for Apache, NGINX, and other servers and applications are listed here: https://support.cloudflare.com/hc/en-us/articles/200170786-Restoring-original-visitor-IPs

  1. You’re getting attacks from Cloudflare’s IPs because they are being spoofed. Cloudflare does not send traffic over anything other than http:// (ports 80 and 443), so getting attacked by UDP requests means you are likely seeing a DNS amplification attack, see this article for more information.

If your situation does not fit any of the circumstances listed above, please provide the information requested below via ticket and we can provide solutions for handling an issue that looks like an attack from us.

Required information to investigate:

  • source IP(s) you are seeing the traffic from
  • destination IP(s) on your side
  • IP packet contents
  • (if possible) tcpdump output in -vvv -s0 -n format

Helpful resources

Kindly,

3

I understand the above, the problem wasn’t us getting attacked.
Just wanted to communicatie that the cloudflare front-end proxy ip was listed on the abuse list which caused Fortiproxy/Fortinet to block it.
Didn’t see any other contact info unless you have a business account to inform you. (Is there another way to contact in case of a similar problem?)
But I see it isn’t listed anymore in the abuse list, so should be ok.

4

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.