How long does cloudflare block an IP address

General
1

What is the name of the domain?

shortlinksfaucet.xyz

What is the issue you’re encountering

API Request Timeout Issues When Accessing linkforearn.com

What are the steps to reproduce the issue?

Hi Support Team,

Yesterday, we experienced a significant increase in user traffic to our website. For each user interaction involving a specific shortlink, our hosting server initiates an API request to the linkforearn.com website, which is protected by Cloudflare.

We have encountered an issue where these API calls are timing out after a few seconds without receiving any response. It appears that our server is unable to establish a successful connection to linkforearn.com. We suspect that this might be due to IP blocking by Cloudflare.

Could you please confirm whether Cloudflare returns any response when an IP address is blocked? Additionally, this behavior is causing our server to wait until the default network timeout, which is impacting performance.

I would appreciate it if you could provide clarification on the following:

How long does Cloudflare typically block an IP address?

What are the default rate limits for the free plan?

At what request rate (requests per second) does Cloudflare consider traffic to be abnormal or abusive?

Thank you for your assistance.

2

You will need to contact the site you are using as they set the rules for access, or they are using Cloudflare features that have limits. They have the analytics that will tell them if your requests are blocked and why. Cloudflare won’t give you any information about a customer’s settings.

Cloudflare does not just drop HTTP traffic. Rejected HTTP requests will always receive an HTTP response, and may include a Cloudflare 1XXX error code in the body. If you are not getting a response from Cloudflare and get a timeout you will need to check the route between you and Cloudflare for problems.

4

Thank you for the response. The owner of the website did not make any changes to cloudflare recently to block this.
However I would like to mention that traceroute command works from the host while curl command results in timeout.
The end IP address is 210.245.72.150 and not 103.221.222.18.
Does this give any information.

traceroute linkforearn.com
traceroute to linkforearn.com (103.221.222.18), 30 hops max, 60 byte packets
1 69.10.36.73 (69.10.36.73) 0.475 ms 0.605 ms 0.618 ms
2 67.217.55.146 (67.217.55.146) 60.090 ms 60.393 ms 67.217.55.145 (67.217.55.145) 17.944 ms
3 v4069.hgsw4-teb6.trouble-free.net (64.20.32.105) 6.970 ms v4068.hgsw3-teb6.trouble-free.net (64.20.32.103) 6.062 ms 6.205 ms
4 ae48-4078.core2-teb4.trouble-free.net (64.20.32.151) 0.763 ms v4061.core1-teb3.trouble-free.net (64.20.32.246) 1.175 ms 1.376 ms
5 v4060.core1-teb3.trouble-free.net (64.20.32.244) 0.970 ms ewr-b12-link.ip.twelve99.net (62.115.236.49) 0.376 ms v4060.core1-teb3.trouble-free.net (64.20.32.244) 1.312 ms
6 ewr-b12-link.ip.twelve99.net (62.115.236.49) 0.370 ms 19.340 ms nyk-bb5-link.ip.twelve99.net (62.115.135.118) 1.223 ms
7 nyk-bb5-link.ip.twelve99.net (62.115.135.118) 1.258 ms * *
8 * * *
9 den-bb2-link.ip.twelve99.net (62.115.137.114) 39.475 ms * *
10 * palo-bb2-link.ip.twelve99.net (62.115.139.112) 67.776 ms *
11 sjo-b23-link.ip.twelve99.net (62.115.139.117) 65.583 ms sjo-b23-link.ip.twelve99.net (62.115.139.17) 66.101 ms tky-b2-link.ip.twelve99.net (62.115.123.141) 182.914 ms
12 * * tky-b2-link.ip.twelve99.net (62.115.113.83) 172.562 ms
13 tky-b4-link.ip.twelve99.net (62.115.139.21) 173.360 ms 173.359 ms tky-b2-link.ip.twelve99.net (62.115.113.83) 172.619 ms
14 hnk-b4-link.ip.twelve99.net (62.115.139.222) 223.820 ms tky-b4-link.ip.twelve99.net (62.115.139.21) 173.116 ms tky-b2-link.ip.twelve99.net (62.115.140.25) 173.981 ms
15 fpttelecom-ic-379629.ip.twelve99-cust.net (213.248.82.121) 222.357 ms * osa-b2-link.ip.twelve99.net (62.115.140.125) 178.268 ms
16 fpttelecom-ic-379629.ip.twelve99-cust.net (213.248.82.121) 224.973 ms 218.166 ms *
17 * fpttelecom-ic-379629.ip.twelve99-cust.net (213.248.82.121) 223.302 ms *
18 * * 118.68.199.245 (118.68.199.245) 260.135 ms
19 118.68.199.245 (118.68.199.245) 260.357 ms 118.69.84.134 (118.69.84.134) 244.676 ms 248.417 ms
20 118.68.199.245 (118.68.199.245) 242.365 ms 118.69.84.134 (118.69.84.134) 247.684 ms 210.245.72.150 (210.245.72.150) 248.603 ms
21 * * 210.245.72.150 (210.245.72.150) 242.921 ms
22 * * *
23 * * *
24 * * *
25 * * *
26 * * *
27 * * *
28 * * *
29 * * *
30 * * *
5

Neither of those are Cloudflare IP addresses. The site doesn’t use the Cloudflare proxy for its domain name. Any problems connecting to those IPs or linkforearn.com are not related to Cloudflare.

I have seen it use the proxy for some subdomains such as step36.linkforearn.com. You may see 5XX errors for timeouts for proxied domains if the connection from Cloudflare to their origin is also poor.

1 Like
6

The IP address 210.245.72.150 is from FPT Telecom. FPT Telecom is Cloudflare’s official distributor in Vietnam, Laos, and Cambodia.

The problem is with main domain and not the subdomain from the hosting server.
The hosting server makes request to main domain to get the shortened URL.

7

There are not Cloudflare related headers in the response to a curl to that website. It’s not using Cloudflare.

❯ curl -Ikv https://linkforearn.com
* Host linkforearn.com:443 was resolved.
* IPv6: (none)
* IPv4: 103.221.222.18
*   Trying 103.221.222.18:443...
* Connected to linkforearn.com (103.221.222.18) port 443
* ALPN: curl offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256 / [blank] / UNDEF
* ALPN: server accepted h2
* Server certificate:
*  subject: CN=linkforearn.com
*  start date: Jun  2 07:52:03 2025 GMT
*  expire date: Aug 31 07:52:02 2025 GMT
*  issuer: C=US; O=Let's Encrypt; CN=R11
*  SSL certificate verify ok.
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://linkforearn.com/
* [HTTP/2] [1] [:method: HEAD]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: linkforearn.com]
* [HTTP/2] [1] [:path: /]
* [HTTP/2] [1] [user-agent: curl/8.7.1]
* [HTTP/2] [1] [accept: */*]
> HEAD / HTTP/2
> Host: linkforearn.com
> User-Agent: curl/8.7.1
> Accept: */*
>
* Request completely sent off
< HTTP/2 200
HTTP/2 200
< x-powered-by: PHP/8.2.28
x-powered-by: PHP/8.2.28
< set-cookie: AppSession=l34b07ogi0qtc9i43e0s6r1nm3; path=/; HttpOnly; secure
set-cookie: AppSession=l34b07ogi0qtc9i43e0s6r1nm3; path=/; HttpOnly; secure
< expires: Thu, 19 Nov 1981 08:52:00 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
< cache-control: no-store, no-cache, must-revalidate
cache-control: no-store, no-cache, must-revalidate
< pragma: no-cache
pragma: no-cache
< content-type: text/html; charset=UTF-8
content-type: text/html; charset=UTF-8
< date: Tue, 17 Jun 2025 14:10:56 GMT
date: Tue, 17 Jun 2025 14:10:56 GMT
< server: LiteSpeed
server: LiteSpeed
< x-xss-protection: 1; mode=block
x-xss-protection: 1; mode=block
< x-frame-options: SAMEORIGIN
x-frame-options: SAMEORIGIN
< x-content-type-options: nosniff
x-content-type-options: nosniff
< vary: User-Agent
vary: User-Agent
< alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
1 Like
8

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.