How to find visitior ip address from query string and ASN

Hi Team, one person continuing abusing our website. We able to track his query string and asn. How to find ip realated to asn or query string? In Cloudflare Analytics > traiffc we unable to track ip from query string and asn, though we able to see hits and user agent.

Only Firewall Events dashboard provides such a level of detail, but of course the incoming traffic must trigger any of the Cloudflare security features (e.g. WAF, Firewall Rules, Security Level) for the logs to show up in Firewall Events dashboard.

so how to find his ip?

Perhaps honeypot the ASN or query string by creating a firewall rule:

(http.request.uri contains “query.string”) then js challenge or allow
or
(ip.geoip.asnum eq 1234) then js challenge or allow

Then you’ll have that person’s ip when you look at that firewall rule’s activity.

Not an elegant solution, but it will show you their IP.

1 Like

thanks jrobbins
I

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.