Hi Community, I am facing an issue that my waf has been detecting a lot of traffic coming from IP t

Hi Community,

I am facing an issue that my waf has been detecting a lot of traffic coming from IP that are actually Cloudflare IPs and I think this is because of the CDN. I want to know the details about it - what these IPs are exactly?, what is being done? and what should I do so that waf does not generate the alerts for this?

TTarunjot Singh Hi Community, I am facing an issue that my waf has been detecting a lot of traf...

Isaac McFadyen•2/21/25, 12:14 PM

This is likely users on Cloudflare WARP, which is Cloudflare's VPN-like service.

Isaac McFadyen•2/21/25, 12:15 PM

We'd need to know more details about which rule is triggering to know why they're being blocked.

Original message was deleted

Isaac McFadyen•2/21/25, 1:02 PM

Sites where you sign up to get money are absolutely scams, I'm afraid to say.

Isaac McFadyen•2/21/25, 1:03 PM

Unless you're actually doing work for the money then there's no reason they'd just give you money for free.

Anton•2/21/25, 1:03 PM

IIsaac McFadyen Sites where you sign up to get money are absolutely scams, I'm afraid to say.

Anton•2/21/25, 1:08 PM

but I have to work to withdraw money

Anton•2/21/25, 1:09 PM

have to earn giftcard or survey

Oo7 Is smart placement not recommended for applications with globally spread databas...

o7•2/21/25, 2:17 PM

bump

D5•2/21/25, 2:37 PM

Are those drops in the Cloudflare radar chart normal?
Are they accurate?

DD5 Are those drops in the Cloudflare radar chart normal? Are they accurate?

Isaac McFadyen•2/21/25, 2:49 PM

Given that's at 3AM I would expect so, yeah.

Isaac McFadyen•2/21/25, 2:49 PM

If you see the dotted line that's the previous week

Chaika•2/21/25, 2:49 PM

you can see the previous week trend line doesn't seem to deviate

Isaac McFadyen•2/21/25, 2:50 PM

So the fact that it lines up means it's expected

IIsaac McFadyen Given that's at 3AM I would expect so, yeah.

D5•2/21/25, 3:02 PM

But the left one went from almost max to min :NotLikeThis:

DD5 But the left one went from almost max to min :NotLikeThis:

Isaac McFadyen•2/21/25, 3:10 PM

I expect it just looks like that because:

There are a lot of users
Most of those users are in a few numbers of region/time zone, so at 3AM all those users aren't on the site.

IIsaac McFadyen I expect it just looks like that because: 1. There are a lot of users 2. Most of...

D5•2/21/25, 3:17 PM

I thought it was due to routing issues because I can't find any logic that the entire country traffic goes suddenly down more than a 60%

D5•2/21/25, 3:19 PM

Well, not routing issues but random potential blockings

Isaac McFadyen•2/21/25, 3:27 PM

Doubtful unless the routing issues occur at the same time every week consistently

Isaac McFadyen•2/21/25, 3:28 PM

Possible but unlikely.

D5•2/21/25, 3:29 PM

It's not happening all week I think

Mozzy•2/21/25, 4:14 PM

I stopped receving these monthly emails? How can I subscribe again? I don't see this as a type under the Notifications area

Original message was deleted

D5•2/21/25, 5:31 PM

Big drops

MMozzy I stopped receving these monthly emails? How can I subscribe again? I don't see ...

D5•2/21/25, 5:32 PM

Only 700firewall events?

D5•2/21/25, 5:32 PM

Never got any similar email

Mozzy•2/21/25, 6:44 PM

I miss them

MMozzy I stopped receving these monthly emails? How can I subscribe again? I don't see ...

asuffield•2/21/25, 9:37 PM

I'm not certain which one that email is on, but try "Web Analytics" under notifications

Aasuffield I'm not certain which one that email is on, but try "Web Analytics" under notifi...

Mozzy•2/21/25, 9:40 PM

Web Analytics is this:

asuffield•2/21/25, 9:40 PM

okay, different email. oh well

FFriday Candour Hello team, can I use total tsl for my deep sub domain structure for free?

Laudian•2/21/25, 11:45 PM

No, Total TLS is not free. It requires the Advanced Certificate Manager addon.

FFriday Candour Is there a way to get around sll certificate for 2 level subdomain without much ...

Laudian•2/21/25, 11:47 PM

Change your DNS record to DNS-Only and use a free certificate on your server.

FFriday Candour Just did that on a cname record to fly.io application but I get ERR_CONNECTION...

valkyrie_pilot•2/22/25, 2:37 AM

you need to provision a fly SSL cert for that to work

chickahoona•2/22/25, 7:37 AM

Hi, I know CF doesn't have any bandwidth limits on the free plan. But I was wondering if I should upgrade from Free to Pro as I have customers complaining there about slow bandwidth throughput. Is there a chance that the upgrade routes the traffic "better" or the traffic is being "prioritized" during rush hours if I upgrade to Pro?

chickahoona•2/22/25, 7:39 AM

I know network latency / routing / bandwidth problems are hard to troubleshoot. So I'd be happy if someone with some background knwoledge could give me an "educated guess" if the plan adjustment has any influence of Cloudflare network performance

Original message was deleted

Mozzy•2/22/25, 10:15 AM

That is the image I posted which isn't the correct email type

Original message was deleted

Erisa•2/22/25, 3:05 PM

yep, this

Cchickahoona Hi, I know CF doesn't have any bandwidth limits on the free plan. But I was wond...

Erisa•2/22/25, 3:07 PM

if your free site is slow, you are sure it isn't your origin server and especially if you have users in locations with more expensive bandwidth (asia, africa, south america) then trying out pro isn't the worst decision you could make.
If you're fine paying for bandwidth you can also try argo smart routing which is expensive but very useful for this kind of optimisation

ADMIN (NEVER DM FIRST)•2/22/25, 3:10 PM

Anyone with Solana gateway for sale?

chickahoona•2/22/25, 7:34 PM

Thanks, that was helpful!

D5•2/22/25, 7:59 PM

Hello! My websites and overall services are partially blocked or with degraded performance here in spain due to ISPs aplying blockings to prevent football piracy (they block completely or partially Cloudflare's IP).

If I switch to Cloudflare Pro plan, I'm going to get a different IP address?

andrew_nyr•2/22/25, 8:36 PM

Each plan can use different IP addresses but it is not definite that it will not also be used by the same services. I would reach out to the ISP and talk to them.

Vinicius•2/22/25, 10:17 PM

I deleted all the pools and now I can't create new ones, this message is showing saying that I used them all

Vinicius•2/22/25, 10:33 PM

Can anyone help me?

Aandrew_nyr Each plan can use different IP addresses but it is not definite that it will not...

D5•2/23/25, 9:16 AM

The ISP is not going to solve anything unfortunately.
They are required to block it by LaLiga

Hi Community, I am facing an issue that my waf has been detecting a lot of traffic coming from IP t

Similar Threads