Unknown visitors (or bots) are visiting our site - how to get an IP report

origin

#1

Hi everyone,

We have a private website/platform that has recently have had a spike in traffic from overseas, opening URLs that are supposed to be private (not published anywhere).

Does Cloudflare offer a report for a specific date that shows the IPs that hit a particular page on the platform?

We are not a very busy website but we are getting on average 10-20 hits a day from Hong Kong for a URL that has not been disclosed to anyone as yet and is not able to be found on Google.

So we are trying to identify if this is an individual IP address or if its multiple IPs and wish to block it.

Any advise would be much appreciated!


#2

Are you not rewriting Cloudflare’s IP addresses to the clients’ ones?


#3

I’m not sure i fully understand what you are saying.

All client Geolocation’s are appearing correctly as our website hit results for the locations are accurate.
We are just trying to determine if the recent (and on going) spike is due to a bot as it is visiting URLs that havn’t been publized only created.

I just wanted to know if Cloudflare also report on all IPs that hit our website and how to view that report?


#4

I am afraid, I am not quite sure either what it precisely is you are looking for.

Why would you need Cloudflare for that? You can get that report from your own logs.

Are you on the free or a paid account? At least for the former I wouldnt be aware of anything more than what they offer in the Analytics section.


#5

Hi Sandro,

I just checked Awstats at it looks like most of the IPs are Cloudflares IP and yes we are on a paid plan for the last 5 years.


#6

Cloudflare IPs would mean you do not rewrite the IPs as mentioned earlier.


#7

Thanks sandro, i am hosting with Host gator and apparently they have mod_cloudflare i just need to check if its really running on there … just need to work out how to use putty/ssh


#8

I think they are being re-written as when i use the portal it logs by local IP in the raw access cpanel log… and i can see some other customers IPs but there are also a lot of CF IPs in there, perhaps due to caching bots?


#9

I am sorry, this is not quite clear to me. It either shows the Cloudflare addresses - when not translated - or the actual clients’ ones - when translated - but not a mixture (unless something is horribly misconfigured :wink: ).

If the addresses are translated, you should have all the information you need to determine where they come from. If they are not, you’d need to change the configuration, so they will be from now on.


#10

Thanks Sandro :slight_smile:


#11

This topic was automatically closed after 14 days. New replies are no longer allowed.