One specific Bot IP cannot get blocked - No idea why

Hi, I am tryting to get rid of a spam bot with the IP 47.76.35.19, but all tries to block it were not succesful. I tried it with custom rules by blocking the IP or blocking the ASN “AS45102” or even blocking the request method “HEAD” there. Nothing. However, it does work with other Bots or even my own IP address for testing. Also tried with the WAF tools for IP access blocking with either IP or IP CIDR (47.76.35.0/24) or also ASN there. That did also not work. It still works for other IPs or even the same ASN from other hosts.

Here is a screenshot of the event:

Any help is appreciated. Thank you :slight_smile:

2 Likes

As an additional answer: All subdomains are proxied.

2 Likes

the same. very interesting.

1 Like

Same issue, same IP

2 Likes

Same issue for the last 7 days. The ddos or scraping attack started small but is increasing (>50k access yesterday). Am I wrong to think that 47.76.35.0 is actually a Cloudflare address and that is why Cloudflare doesn’t block it? as in, bots actually have a different ip address that Cloudflare turns into 47.76.35.0 ?

Sorry I don’t know too much about this so I don’t know if this makes sense.

Method is also always head, then it points to pages made up of multiple url paths pasted one after another like in your case. That causes a 301 answer from my server which is why I guess it might be a ddos attempt.

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.