Hello fellow Cloudflare users! I need YOUR help. So I’ll try to give you a quick backstory here:
I develop discord bots on a VPS in my freetime for what is supposed to be fun… and the bot uses a wide range of APIs. I took a break from developing the bot for around ~6months and came back to it this week
All/most APIs have stopped working since, which is a development nightmare for me and they are throwing mountains of Cloudflare forbidden errors in my face and I have come to the conclusion the VPS IP has been banned/restricted/suspended. The support tickets seem confusing and hard to navigate and the bot replies really don’t help - I need humans for once. I would love for the vps to be unbanned ASAP but documentation on stuff like this is terrible and none of cloudflares support websites provide clear ways to appeal or even just discuss issues like this with real staff so here I am. A friend has told me it may be worth mentioning the VPS is hosted on OVH and apparently Cloudflare doesn’t like OVH IPs…
If I can’t get the IP unrestricted I (and most other developers) will have to resort to:
Buying a whole new VPS (do I look like jeff bezos)
Trying to spoof IPs/messing with proxies/etc a whole world of tricky concepts which probably are the last thing Cloudflare wants lmao
My questions to You:
How do I get the VPS unbanned?
(For context, I have also opened a support ticket but that has been lifeless)
Ay! Thank you so much for your very speedy reply. I know I come across as frustrated, it has taken me days of troubleshooting to come to those conclusions and the frustration just mounts and mounts anyway… I have attached below one example of the error I am recieving from one API. My theory is that before the sites recieve my request, the requesting IP is being checked/verified by Cloudflare and Cloudflare is flagging the IP and throwing some sort of captcha or restriction which prevents me from ever making the request.
I have no way of checking what is blocking the requests since I do not own/develop/manage the APIs that I request
I have recieved no emails from Cloudflare, I do not use proxies nor do I intend to, it was just a suggested solution to the issue to which I will not be pursuing
My ticket number is 2493294 I opened it quite recently
Lastly, thank you. I really do appreciate the support and if my theory turns out to be totally and utterly incorrect then I am very sorry for bothering you.
If the request is coming from your VPS, I’d suggest you to whitelist the origin host/server IP by navigating to the Cloudflare → Security → Tools → IP Access Rules with the action “allow” for your Website.
Should look like on the below screenshot as an example:
It appears my explanation was poor,
I do not have access to the website I am accessing because I am making a request from my server to their website (API). I make a GET request from my server to their website where they recieve and process my request giving me a json response.
I cannot access their website which uses Cloudflare so I cannot whitelist the IP and I cannot check if it is being blocked or restricted. I do not manage the websites I am requesting so I cannot check for bot fight mode or the security level.
Oh that is actually a very good point. I already have a domain that is registered with Cloudflare I will send a request and see if I can replicate the error.
+I do not believe these websites/APIs are blocking me intentionally, I think Cloudflare is flagging the IP for the vps and asking for a re-captcha which obviously it cannot complete. The ideal fix is to work out what list - as such - the IP is on and then getting it removed from that or unrestricted etc, I never used to have this issue so Cloudflare has flagged the ovh vps IP and that is what I want to get to the bottom of.
The thing is, for example most abuse comes from known hosting providers, even from Amazon servers, Digital Ocean, or Hetzner, or some others, while OVH might be the one for some not sure which, reason, if so, but… but we all have services on them, right? And they do work normally so far so good.
Unfortunately, I cannot confirm and say Cloudflare is blocking the whole or a part of OVH’s IP ranges as far as this can’t be true what I know and believe that would really not be a good way to go for Cloudflare.
See my above post supplemented about Cloudflare Verified Bot - might help you (2nd idea after 1st about testing with your own domain):
Just tested by sending a request to one of my Cloudflare domains, and it is also being flagged on my website too. The response from curl conveniently shows the HTML of the webpage and is exactly as I suspected - Cloudflare seems to have put the vps on a list of “suspicious” IPs or otherwise and proceeds to try and check or verify the request probably with a captcha prior to letting me into the webpage, thus making it impossible for the vps to ever make an API request
And yes your idea about a verified bot actually sounds quite promising and I will be sure to look into it
Also just adding to your verified bot idea, i took a closer look and I noticed in the documentation it states to allow a verified bot to make requests you have to enable a toggle on the webpage. Is that enabled by default? If it isn’t, then surely this defeats the point and does not solve the issue.
Indeed Albertus it seems the verified bot idea will be extremely difficult, and at the end of it all it probably won’t fix the issue.
The real issue that needs addressing here is the clear evidence that Cloudflare has a list of sorts containing IPs they believe to be suspicious and my VPS is clearly on said list. The only feasible way the issue can be resolved at this stage is by getting it removed from that list. As I said before, I never used to have this issue and it was only recently that Cloudflare began checking the requests made by my VPS before they were recieved by the APIs and so whatever list or whatever changed that made the IP be flagged whenever it makes requests (bearing in mind, if Cloudflare intercepts an API request it makes the request void and the user gets a 403 error) needs to be reverted because it is unjust and unfair. I have not done anything to deserve these ramifications and have made every effort to resolve them.