Is this IP (104.28.224.151，104.28.224.152) the one you use for scanning

General Dashboard
,
1

What is the name of the domain?

server.server

What is the issue you’re encountering

attacked

What steps have you taken to resolve the issue?

On my server, block all access requests from (104.28.224.0/24).

What are the steps to reproduce the issue?

Is this IP (104.28.224.151，104.28.224.152) the one you use for scanning。
Because all of my websites use Cloudflare’s CDN service. So I’m not sure if it’s your source IP… I found it frantically trying to inject into my server. If I block it. Will it affect my CDN service
These two IPs injected me with SQL more than 10000 times in less than an hour.
I have blocked all requests from (104.28.224.0/24) on my server.
At the same time, I have disabled all requests from AS13335- Cloudflare, Inc. in my Cloudflare WAF feature.
Will this affect my use of Cloudflare’s CDN service

2

The 104.28. IPs are not in the list of proxy IPs so are from WARP users. You can block it no problem. You can also block Cloudflare’s AS13335 on Cloudflare if you want and the proxy will still work, but if you use any Cloudflare features like health checks or Workers/Snippets that make sub requests to your zone then those will be blocked if you do that.

1 Like
3

And these two IPs are launching crazy attacks on my server…
Mainly because I am https://www.cloudflare.com/ips-v4/# I see that these two IPs belong to Cloudflare
So I’m here to consult

4

As mentioned, those 2 IP addresses are not used by the Cloudflare proxy (they are not covered by the 104.24.0.0/14 range in the published list), they are used by Cloudflare WARP users, so…

2 Likes
5

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.