Strange code showing on my site

Hello all,

I got across this problem, that some code: /cdn-cgi/bm/cv/2172558837/api.js is showing up on my site and at bottom I have this code:

I changed my host (with no files uploaded to the new one) for some minutes and that file still exists when access it directly (adding some query string at the end).
What is this file? Is some kind of virus? How to make it disappear?

1 Like

I have change the cloudflare account to another and that issue is gone. Why is this showing up and how to stop it?
I have the same problem on other site too… Don’t want to move all sites to new account…

My guess would be this is “Bot Management”. Do you have a respective setting under https://dash.cloudflare.com/?to=/:account/:zone/firewall/settings?

Generally that should be Enterprise-only, and I presume you do not have such a plan, but I remember from a while ago that the feature was seemingly active on a non-Enterprise plan too.

You might want to contact support for clarification.

This I have on that page:

I think this started to show up after I have tried a code like:
var vid = new XMLHttpRequest();
vid.open(‘GET’, url, true);
vid.responseType = ‘json’;
vid.onload = function() {
callback(null, vid.response);
};
vid.send();

I’m not a expert in javascript but I tried to make a code that every user if requests a page will make a “grab content” from other page and show it up. I just noticed that this api.js came up after I did this. Maybe it isn’t from this but it was curious that this showed up after I did this.

Have the same problem. I found this script when troubleshoot the inability of Yandex bot to read the verification code from the html file.
If you reload the page several times the script will disappear, but for sure it doesn’t help to pass the verification.
Tried to switch off all the suspicious options in control panel but with no success.

Yea I have tried the same like disable all options in cloudflare and still nothing.
I have changed host (with no content on it) to check if the problem is from current host but that file still exists…
I have emailed this problem to Cloudflare support but support takes ages from what I see.

1 Like

This topic was automatically closed after 30 days. New replies are no longer allowed.