Firewall rule not working with referral traffic

Getting Started
#1

Not sure if this is done correctly but we are starting to get referral traffic from an unknown source. We tried to make a firewall rule but still does not seem to be working

any help is appreciated attached are images

Screen Shot 2020-03-29 at 8.01.40 PM
Screen Shot 2020-03-29 at 8.01.40 PM2226×902 126 KB

#2

This is the correct image

Screen Shot 2020-03-29 at 8.07.24 PM
Screen Shot 2020-03-29 at 8.07.24 PM2192×496 33.5 KB

#3

I’d leave off the .club part since you’re only doing a ‘contains’ match.

Are you actually seeing that Referer header in your logs?

#4

yes this is how it appears in analytics

Screen Shot 2020-03-29 at 8.00.51 PM
Screen Shot 2020-03-29 at 8.00.51 PM694×150 8.64 KB

#5

That should do it, then. Can you post the domain so we can verify if the rule works? There’s always the chance they’re bypassing Cloudflare and hitting your origin directly. In which case you’d need to firewall off anything not coming from Cloudflare IP addresses.

#6

That is all i have on that site if you type it in it goes to https://www.gammatraffic.com/

#7

I just tested this on my test domain. It looks like the dot in the referrer hostname is a problem. Get rid of the .club and it should work.

#8

Ok this is what it looks like as of now to be sure. Sorry im fairly new to cloudflare

Screen Shot 2020-03-29 at 8.43.26 PM
Screen Shot 2020-03-29 at 8.43.26 PM2348×834 56 KB

#9

I can’t see what’s below that if you’ve set it to Block. Also, is this the first rule in your Firewall Rules list?

I ask because it’s not working like mine does.

Screen Shot 2020-03-29 at 5.51.46 PM
Screen Shot 2020-03-29 at 5.51.46 PM2138×1110 131 KB

Screen Shot 2020-03-29 at 5.53.05 PM
Screen Shot 2020-03-29 at 5.53.05 PM1634×1516 398 KB

#10

Yes this is my first rule. It does not seem to be working on ours

#11

Time to start experimenting with crazy Firewall rules, like blocking your own IP address, Country, or some random URL/path/filename. Something has to work.

#12

Yea i was going to block countries seems like it comes from france and ukraine. I did try and reach out to the company to find out why traffic was coming.

Thanks for the help ill leave it as is and see if anything changes.

1 Like
#13

When i decided to block by countries it seems to work. Very strange

Screen Shot 2020-03-29 at 9.27.36 PM
Screen Shot 2020-03-29 at 9.27.36 PM2102×192 13 KB

1 Like
#14

Hi, having same issue, can’t block this spam traffic ussing “referral” contains.

Can you please explain a lil’ bit about blocking by country rule in this case?

#15

This topic was automatically closed after 31 days. New replies are no longer allowed.