Crazy amount of guests

[Alvin63]

What is the one rule to rule them all?

It’ll be site individual. On my site, under security/analytics, it showed 1.1 million of 1.3 million requests - all residential proxies, came from desktop - about 50/50 Mac and Windows and a smaller amount of Linux - and 99.9% of them were only going to one pathway - Whats-New. None of the IP's carried a referer from log analysis. (Server log analysed by Claude). 30% of them could solve challenges and get past Cloudflare. Also on my site virtually all guests and members use mobile. There were no further rules to add if there was a peak swarm if they solved challenges.

So it seemed an idea to block requests from desktops that visit Whats New - the rule blocks the desktop IP's except for xf-user and has a referer so members bypass it and the rare genuine guest using a computer doesn’t get blocked due to the referer. While my numbers weren't as high as some people are getting, it could be very useful rather than running around looking up ASN's and blocking countries.

It stopped virtually all the residential proxies dead and then there were just some US data centres revealed, so they were added to a challenge which stopped nearly all of those - low solve rate. After a few days only a few residential proxies evolved to adding a referer or switching to mobile and as a test they were stopped by a finger printing rule - which stopped half of the rest of them. It wasn't so much about stopping those remaining ones as working out what they did to bypass it in case more did the same. The other half could solve challenges and got through but very low numbers. Also a few residential proxies going to other paths but most of those couldn't solve challenges.

So the destop rule blocked the worst of them. It's still working a few days later.

So it's site dependent and bot swarm dependent - if your bots are mainly hitting whats new, without a referer and most of them are using desktop, it should work for others as well. If more of your users use desktop they shouldn't be blocked if a referer is added but more risky for a site with people who use computers rather than mobiles.

Block:

starts_with(http.request.uri.path, "/whats-new") and (http.user_agent contains "Windows NT" or http.user_agent contains "Macintosh" or http.user_agent contains "X11") and not http.user_agent contains "Android" and not cf.client.bot and not http.cookie contains "xf_user" and not http.referer contains "thehamsterforum.com"

It dropped from 1.7 million requests down to this in about 5 minutes. Whether it continues to work remains to be seen. But the result is I only have genuine members and guests, genuine robots and occasionally the odd few getting through to my site. So it's about having control partly and also choosing who crawls the site. But also about stopping residential proxies that solve challenges.

 

[Anthony Parsons]

starts_with(http.request.uri.path, "/whats-new") and (http.user_agent contains "Windows NT" or http.user_agent contains "Macintosh" or http.user_agent contains "X11") and not http.user_agent contains "Android" and not cf.client.bot and not http.cookie contains "xf_user" and not http.referer contains "thehamsterforum.com"

What is the one rule to rule them all?

I would not use that rule @ekool.

The rule is poorly constructed and targets every legitimate desktop using Windows NT, Macintosh and X11. This rule is not distinguishing legit from malicious traffic.

Android and IOS visitors are not even affected by this rule. There is so much wrong with it, to be honest.

Bare minimum, if anyone does use it, DO NOT use BLOCK, use Managed Challenge, that way legitimate users affected can work around it quickly.

Affected Users being Blocked

New Windows visitor arriving from Google - Yes
New Mac visitor opening a shared What's New link - Yes
Linux desktop visitor using an X11 user agent - Yes
Returning guest using a bookmark - Yes, if no qualifying referrer
Logged-in member without xf_user cookie - Yes, if no qualifying referrer
Member using private browsing without persistent login - Yes, if no qualifying referrer
Windows visitor with browser referrer suppression - Yes, if no xf_user cookie

People often don't understand the consequences they create when making CF rules, try and stop one thing, ultimately stop a whole lot more than they set-out to, OR, the rule does not do its job equally and has gaping holes in it.

 

[Alvin63]

It's only for What's New - not desktops on the site entirely - just desktops going directly to Whats new:

Windows visitor arriving from Google: Google doesn’t send people to /whats-new pages, so this would essentially not happen.
Shared What’s New link, bookmark, referrer suppression: these are real cases, but only for someone who has the /whats-new address saved or shared. Rare, though not impossible.
Logged-out or private-browsing member: true - but only if they go to /whats-new directly and they'd find it from the home page so would have a referer. Most people dont type forum name/whats-new into a web browser.

As I mentioned it could be site dependent - it's rare any genuine guests or members on my site use desktop anyway. Logs show no blocked real users. The referer seems to resolve that as most would land on a thread or home page before clicking on whats-new.

However as I said a few days ago, it was also partly a test. Some of the bots are getting past it now by going direct to thread names instead of whats-new - not many of them. The only plus to that is they can only scrape older posts they already know, not new ones. I think. It's still blocking most of the automated residential proxies.

But point taken - it's not for everyone - depends on your bots, statistics and members/devices.

 

[smallwheels]

during the spike about 1.450 IPs were blocked but sadly about 1.000 passed.

As I've already seen that there were quite some IPs from the US involved it is clear that Bot Guard has ignored them - the question is why. Same goes for traffic from other countries: I would have expected (or rather hoped for) a peak in challenges between 8 and 9 pm, but there was none.

It may be, that these bots were targeting non existent pages

Turns out the latter was the case: Those bots almost all went for "/wordpress/", which does not exist on my page:



So it was totally fine for Bot Guard to let them pass as they would hit a 404 anyway.

Sadly, a suspicion I had for quite some time was confirmed as well: "iCloud Private Relay" is used by bots as well. Initially I had the assumption that requests coming from there would typically be genuine as I assumed It would be tied to Safari as a Browser (and mainly tied to Mac and iPhones, so probably less likely to be infected by bots). However: I became somewhat suspicious as I got quite a bunch of connections via iCloud Private Relay from all over the world while my core audience is in the DACH region and iCloud Private Relay is using exit points that reflect the original geographical area of the requester.
Now I found these in my logs and a bunch more of that kind:




So sadly, iCloud Private Relay cannot considered to be bot free.

 

[smallwheels]

Those bots almost all went for "/wordpress/", which does not exist on my page:

In the logs I also found requests (strangely enough post requests) from a well known bad IP



that within a single minute fired out quite a bunch and rotated the user agent heavily. The user agent patterns may be of interest for those like @Anthony Parsons who use them to identify baddies, as they seem pretty uncommon an easy to spot:

 $ grep "12/Oct/2026:21:39" web.log | grep "/wordpress/index.php"
45.138.12.44 - - [12/Oct/2026:21:39:01 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1258 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1" 2620 1664
45.138.12.44 - - [12/Oct/2026:21:39:03 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9239 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1" 2629 9798
45.138.12.44 - - [12/Oct/2026:21:39:04 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9238 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 2607 9797
45.138.12.44 - - [12/Oct/2026:21:39:05 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1257 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Edg/126.0.0.0" 2615 1663
45.138.12.44 - - [12/Oct/2026:21:39:06 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9240 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1" 2610 9799
45.138.12.44 - - [12/Oct/2026:21:39:10 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9238 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 OPR/111.0.0.0" 2642 9797
45.138.12.44 - - [12/Oct/2026:21:39:11 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1256 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15" 2587 1662
45.138.12.44 - - [12/Oct/2026:21:39:12 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9248 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 2584 9807
45.138.12.44 - - [12/Oct/2026:21:39:13 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9248 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 2616 9807
45.138.12.44 - - [12/Oct/2026:21:39:14 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1257 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Edg/126.0.0.0" 2623 1663
45.138.12.44 - - [12/Oct/2026:21:39:14 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1257 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Edg/126.0.0.0" 2612 1663
45.138.12.44 - - [12/Oct/2026:21:39:15 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9239 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1" 2628 9798
45.138.12.44 - - [12/Oct/2026:21:39:16 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9239 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15" 2590 9798
45.138.12.44 - - [12/Oct/2026:21:39:16 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1258 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 OPR/111.0.0.0" 2594 1664
45.138.12.44 - - [12/Oct/2026:21:39:17 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9238 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1" 2631 9797
45.138.12.44 - - [12/Oct/2026:21:39:18 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1257 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1" 2624 1663
45.138.12.44 - - [12/Oct/2026:21:39:18 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9240 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15" 2584 9799
45.138.12.44 - - [12/Oct/2026:21:39:19 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9237 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15" 2625 9796
45.138.12.44 - - [12/Oct/2026:21:39:20 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9238 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15" 2614 9797
45.138.12.44 - - [12/Oct/2026:21:39:22 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9240 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0" 2540 9799
45.138.12.44 - - [12/Oct/2026:21:39:23 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9237 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15" 2631 9796
45.138.12.44 - - [12/Oct/2026:21:39:23 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9237 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0" 2576 9796
45.138.12.44 - - [12/Oct/2026:21:39:24 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9238 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 2586 9797
45.138.12.44 - - [12/Oct/2026:21:39:25 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9238 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 OPR/111.0.0.0" 2628 9797
45.138.12.44 - - [12/Oct/2026:21:39:26 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9239 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Edg/126.0.0.0" 2637 9798
45.138.12.44 - - [12/Oct/2026:21:39:26 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1256 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1" 2610 1662
45.138.12.44 - - [12/Oct/2026:21:39:27 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1256 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Edg/126.0.0.0" 2630 1681
45.138.12.44 - - [12/Oct/2026:21:39:27 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9237 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0" 4191 16625
45.138.12.44 - - [12/Oct/2026:21:39:28 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1258 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Edg/126.0.0.0" 2602 1664
45.138.12.44 - - [12/Oct/2026:21:39:29 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9240 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 2628 9799
45.138.12.44 - - [12/Oct/2026:21:39:30 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9237 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Edg/126.0.0.0" 2596 9796
45.138.12.44 - - [12/Oct/2026:21:39:31 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9239 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0" 2548 9798
45.138.12.44 - - [12/Oct/2026:21:39:31 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1258 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1" 2647 1664
45.138.12.44 - - [12/Oct/2026:21:39:31 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1258 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0" 2555 1664
45.138.12.44 - - [12/Oct/2026:21:39:32 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9237 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0" 2533 9796
45.138.12.44 - - [12/Oct/2026:21:39:33 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1256 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 OPR/111.0.0.0" 2631 1662
45.138.12.44 - - [12/Oct/2026:21:39:34 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1257 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 OPR/111.0.0.0" 2652 1663
45.138.12.44 - - [12/Oct/2026:21:39:39 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9241 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15" 4204 16629
45.138.12.44 - - [12/Oct/2026:21:39:40 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1259 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Edg/126.0.0.0" 2647 1665
45.138.12.44 - - [12/Oct/2026:21:39:41 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9250 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15" 2615 9809
45.138.12.44 - - [12/Oct/2026:21:39:42 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9250 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Edg/126.0.0.0" 2594 9809
45.138.12.44 - - [12/Oct/2026:21:39:42 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9250 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 2628 9809
45.138.12.44 - - [12/Oct/2026:21:39:44 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9250 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1" 2637 9809
45.138.12.44 - - [12/Oct/2026:21:39:45 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9237 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15" 2598 9796
45.138.12.44 - - [12/Oct/2026:21:39:46 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9240 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 2608 9799
45.138.12.44 - - [12/Oct/2026:21:39:46 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9240 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0" 2568 9799
45.138.12.44 - - [12/Oct/2026:21:39:47 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9237 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15" 2596 9796
45.138.12.44 - - [12/Oct/2026:21:39:48 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1255 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 2620 1661
45.138.12.44 - - [12/Oct/2026:21:39:48 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1259 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 2598 1665
45.138.12.44 - - [12/Oct/2026:21:39:49 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9239 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0" 2560 9798
45.138.12.44 - - [12/Oct/2026:21:39:50 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1257 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15" 2629 1663
45.138.12.44 - - [12/Oct/2026:21:39:50 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1259 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Edg/126.0.0.0" 2618 1665
45.138.12.44 - - [12/Oct/2026:21:39:51 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1256 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 2585 1662
45.138.12.44 - - [12/Oct/2026:21:39:52 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9237 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1" 2637 9796
45.138.12.44 - - [12/Oct/2026:21:39:52 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1258 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15" 2604 1664
45.138.12.44 - - [12/Oct/2026:21:39:54 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1258 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 2586 1664
45.138.12.44 - - [12/Oct/2026:21:39:55 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1258 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1" 2633 1664
45.138.12.44 - - [12/Oct/2026:21:39:56 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9251 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 OPR/111.0.0.0" 2607 9810
45.138.12.44 - - [12/Oct/2026:21:39:57 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1258 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 OPR/111.0.0.0" 2608 1664
45.138.12.44 - - [12/Oct/2026:21:39:57 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1257 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 OPR/111.0.0.0" 2644 1663
45.138.12.44 - - [12/Oct/2026:21:39:58 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9238 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 2603 9797
45.138.12.44 - - [12/Oct/2026:21:39:59 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9238 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 OPR/111.0.0.0" 2606 9797

 

[BrettC]

Turns out the latter was the case: Those bots almost all went for "/wordpress/", which does not exist on my page:

View attachment 347378

So it was totally fine for Bot Guard to let them pass as they would hit a 404 anyway.

Sadly, a suspicion I had for quite some time was confirmed as well: "iCloud Private Relay" is used by bots as well. Initially I had the assumption that requests coming from there would typically be genuine as I assumed It would be tied to Safari as a Browser (and mainly tied to Mac and iPhones, so probably less likely to be infected by bots). However: I became somewhat suspicious as I got quite a bunch of connections via iCloud Private Relay from all over the world while my core audience is in the DACH region and iCloud Private Relay is using exit points that reflect the original geographical area of the requester.
Now I found these in my logs and a bunch more of that kind:

View attachment 347379
View attachment 347380

So sadly, iCloud Private Relay cannot considered to be bot free.

That little finding gives a pretty good idea that these proxies / resi proxies are more or less hijacked devices, or devices where the user/operator of said device is unaware (if they're aware of it - urgh), that their phone is partaking in a proxy network (and possibly a botnet). :-/

 

[smallwheels]

That little finding gives a pretty good idea that these proxies / resi proxies are more or less hijacked devices, or devices where the user/operator of said device is unaware (if they're aware of it - urgh), that their phone is partaking in a proxy network (and possibly a botnet). :-/

I will have to double check if not IP Threat Manager may have classified these IPs falsely as "iCloud private Relay" as on first look they look a bit strange: The first resolves somewhat unexpectedly to "linodeusercontent.com":

$ host 172.235.17.228
228.17.235.172.in-addr.arpa domain name pointer 172-235-17-228.ip.linodeusercontent.com.

while the second one has no rDNS at all:

$ host 17.223.249.124
Host 124.249.223.17.in-addr.arpa. not found: 3(NXDOMAIN)

even more strange is that neither of them shows up in my web.log which should technically be impossible. IPSearch.io classifies neither of them as Part of iCloud Private Relay but the first one to be part of Akamai Cloud in India and the second one belonging to Apple:





So I would currently not see the suspicion see as fully confirmed but the fact that one of the IPs belongs to Apple does make it indeed somewhat smelly. A little bit more digging seems adequate.

Update: The official feed from Apple for iCPR IPs does contain neither of the IPs as it seems: https://mask-api.icloud.com/egress-ip-ranges.csv

 

[BrettC]

You made my heart skip a beat for a moment there. Seen the 172.135 IP segment and thought "oh no, was one of my VPS's involved in doing something naughty!?" then i seen the other half and thought "PANIK AVERTED".

I'd be curious to know more about the Apple VPN / Relay service though. That does need a bit more research.

 

[smallwheels]

I'd be curious to know more about the Apple VPN / Relay service though. That does need a bit more research.

A good starting point is here:

Prepare your network or web server for iCloud Private Relay - iCloud - Apple Developer

iCloud Private Relay is a new internet privacy service built into iCloud that allows users to connect to and browse the web more privately and securely.

developer.apple.com

 

[smallwheels]

I will have to double check if not IP Threat Manager may have classified these IPs falsely as "iCloud private Relay" as on first look they look a bit strange:

It did indeed and the bug has promptly been fixed in the latest version that was just released:

We removed an overly broad legacy fallback range and synchronized strictly with Apple's official egress IP list. Linode and similar datacenter IPs will now be caught and blocked as expected.

 

[smallwheels]

I'd be curious to know more about the Apple VPN / Relay service though. That does need a bit more research.

A good starting point is here:

Prepare your network or web server for iCloud Private Relay - iCloud - Apple Developer

iCloud Private Relay is a new internet privacy service built into iCloud that allows users to connect to and browse the web more privately and securely.

developer.apple.com

additionally, there's an introduction pdf by Apple, dating back to 2021 (but still worth reading):

https://www.apple.com/privacy/docs/iCloud_Private_Relay_Overview_Dec2021.PDF

a blogpost from Cloudflare from 2022 (that does not say more than the pdf but rather less, but is shorter):

iCloud Private Relay: What Cloudflare Customers Need to Know

iCloud Private Relay is an Apple service for browsing more privately and securely. Learn how to ensure the best user experience using iCloud Private Relay.

blog.cloudflare.com

and a recent finding, that iCPR might leak the IP unter certain conditions when passkeys are involved:

Apple's iCloud Private Relay is Leaking Users' Real IP Addresses

Apple's paid Safari protection feature that promises to keep your IP masked doesn't always work, according to security researchers Tommy Mysk and Talal Haj Bakry. It turns out iCloud Private Relay can expose your real IP to websites that use or pretend to use passkeys. iCloud Private Relay is a...

www.macrumors.com

IP and DNS Leaks in WebKit Affecting Proxy Browsers and Apple iCloud Private Relay

WebKit-based browsers on iOS and macOS can be configured to route all web traffic through proxy servers, which is how Tor browsers on iOS and our own Psylo work. We found three WebKit features — DNS prefetching, WebAuthn Related Origin Requests, and WebTransport — that bypass the configured...

mysk.blog

 

[Alvin63]

In the logs I also found requests (strangely enough post requests) from a well known bad IP

View attachment 347381

that within a single minute fired out quite a bunch and rotated the user agent heavily. The user agent patterns may be of interest for those like @Anthony Parsons who use them to identify baddies, as they seem pretty uncommon an easy to spot:

 $ grep "12/Oct/2026:21:39" web.log | grep "/wordpress/index.php"
45.138.12.44 - - [12/Oct/2026:21:39:01 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1258 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1" 2620 1664
45.138.12.44 - - [12/Oct/2026:21:39:03 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9239 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1" 2629 9798
45.138.12.44 - - [12/Oct/2026:21:39:04 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9238 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 2607 9797
45.138.12.44 - - [12/Oct/2026:21:39:05 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1257 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Edg/126.0.0.0" 2615 1663
45.138.12.44 - - [12/Oct/2026:21:39:06 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9240 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1" 2610 9799
45.138.12.44 - - [12/Oct/2026:21:39:10 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9238 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 OPR/111.0.0.0" 2642 9797
45.138.12.44 - - [12/Oct/2026:21:39:11 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1256 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15" 2587 1662
45.138.12.44 - - [12/Oct/2026:21:39:12 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9248 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 2584 9807
45.138.12.44 - - [12/Oct/2026:21:39:13 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9248 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 2616 9807
45.138.12.44 - - [12/Oct/2026:21:39:14 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1257 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Edg/126.0.0.0" 2623 1663
45.138.12.44 - - [12/Oct/2026:21:39:14 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1257 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Edg/126.0.0.0" 2612 1663
45.138.12.44 - - [12/Oct/2026:21:39:15 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9239 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1" 2628 9798
45.138.12.44 - - [12/Oct/2026:21:39:16 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9239 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15" 2590 9798
45.138.12.44 - - [12/Oct/2026:21:39:16 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1258 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 OPR/111.0.0.0" 2594 1664
45.138.12.44 - - [12/Oct/2026:21:39:17 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9238 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1" 2631 9797
45.138.12.44 - - [12/Oct/2026:21:39:18 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1257 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1" 2624 1663
45.138.12.44 - - [12/Oct/2026:21:39:18 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9240 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15" 2584 9799
45.138.12.44 - - [12/Oct/2026:21:39:19 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9237 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15" 2625 9796
45.138.12.44 - - [12/Oct/2026:21:39:20 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9238 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15" 2614 9797
45.138.12.44 - - [12/Oct/2026:21:39:22 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9240 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0" 2540 9799
45.138.12.44 - - [12/Oct/2026:21:39:23 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9237 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15" 2631 9796
45.138.12.44 - - [12/Oct/2026:21:39:23 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9237 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0" 2576 9796
45.138.12.44 - - [12/Oct/2026:21:39:24 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9238 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 2586 9797
45.138.12.44 - - [12/Oct/2026:21:39:25 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9238 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 OPR/111.0.0.0" 2628 9797
45.138.12.44 - - [12/Oct/2026:21:39:26 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9239 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Edg/126.0.0.0" 2637 9798
45.138.12.44 - - [12/Oct/2026:21:39:26 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1256 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1" 2610 1662
45.138.12.44 - - [12/Oct/2026:21:39:27 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1256 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Edg/126.0.0.0" 2630 1681
45.138.12.44 - - [12/Oct/2026:21:39:27 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9237 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0" 4191 16625
45.138.12.44 - - [12/Oct/2026:21:39:28 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1258 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Edg/126.0.0.0" 2602 1664
45.138.12.44 - - [12/Oct/2026:21:39:29 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9240 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 2628 9799
45.138.12.44 - - [12/Oct/2026:21:39:30 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9237 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Edg/126.0.0.0" 2596 9796
45.138.12.44 - - [12/Oct/2026:21:39:31 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9239 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0" 2548 9798
45.138.12.44 - - [12/Oct/2026:21:39:31 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1258 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1" 2647 1664
45.138.12.44 - - [12/Oct/2026:21:39:31 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1258 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0" 2555 1664
45.138.12.44 - - [12/Oct/2026:21:39:32 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9237 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0" 2533 9796
45.138.12.44 - - [12/Oct/2026:21:39:33 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1256 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 OPR/111.0.0.0" 2631 1662
45.138.12.44 - - [12/Oct/2026:21:39:34 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1257 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 OPR/111.0.0.0" 2652 1663
45.138.12.44 - - [12/Oct/2026:21:39:39 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9241 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15" 4204 16629
45.138.12.44 - - [12/Oct/2026:21:39:40 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1259 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Edg/126.0.0.0" 2647 1665
45.138.12.44 - - [12/Oct/2026:21:39:41 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9250 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15" 2615 9809
45.138.12.44 - - [12/Oct/2026:21:39:42 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9250 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Edg/126.0.0.0" 2594 9809
45.138.12.44 - - [12/Oct/2026:21:39:42 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9250 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 2628 9809
45.138.12.44 - - [12/Oct/2026:21:39:44 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9250 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1" 2637 9809
45.138.12.44 - - [12/Oct/2026:21:39:45 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9237 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15" 2598 9796
45.138.12.44 - - [12/Oct/2026:21:39:46 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9240 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 2608 9799
45.138.12.44 - - [12/Oct/2026:21:39:46 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9240 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0" 2568 9799
45.138.12.44 - - [12/Oct/2026:21:39:47 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9237 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15" 2596 9796
45.138.12.44 - - [12/Oct/2026:21:39:48 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1255 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 2620 1661
45.138.12.44 - - [12/Oct/2026:21:39:48 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1259 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 2598 1665
45.138.12.44 - - [12/Oct/2026:21:39:49 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9239 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0" 2560 9798
45.138.12.44 - - [12/Oct/2026:21:39:50 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1257 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15" 2629 1663
45.138.12.44 - - [12/Oct/2026:21:39:50 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1259 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Edg/126.0.0.0" 2618 1665
45.138.12.44 - - [12/Oct/2026:21:39:51 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1256 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 2585 1662
45.138.12.44 - - [12/Oct/2026:21:39:52 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9237 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1" 2637 9796
45.138.12.44 - - [12/Oct/2026:21:39:52 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1258 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15" 2604 1664
45.138.12.44 - - [12/Oct/2026:21:39:54 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1258 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 2586 1664
45.138.12.44 - - [12/Oct/2026:21:39:55 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1258 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1" 2633 1664
45.138.12.44 - - [12/Oct/2026:21:39:56 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9251 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 OPR/111.0.0.0" 2607 9810
45.138.12.44 - - [12/Oct/2026:21:39:57 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1258 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 OPR/111.0.0.0" 2608 1664
45.138.12.44 - - [12/Oct/2026:21:39:57 +0200] "POST /wordpress/index.php HTTP/1.1" 403 1257 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 OPR/111.0.0.0" 2644 1663
45.138.12.44 - - [12/Oct/2026:21:39:58 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9238 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 2603 9797
45.138.12.44 - - [12/Oct/2026:21:39:59 +0200] "POST /wordpress/index.php HTTP/1.1" 404 9238 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 OPR/111.0.0.0" 2606 9797

You mentioned Lietuva - I came across this if it helps. The ASN has residential proxies in the US despite being in Lietuva.

ASN 210906 which IP info says is UAB Bite Lietuva. But IP’s are coming from different countries and it shows as US so it’s a residential proxy. Blocking the ASN would affect potential members from Latvia or Lithuania - but blocked it because the IP's from this source can solve Cloudflare challenges (and it's not a country I'd have members from).

 

[smallwheels]

ASN 210906 which IP info says is UAB Bite Lietuva. But IP’s are coming from different countries and it shows as US so it’s a residential proxy. Blocking the ASN would affect potential members from Latvia or Lithuania - but blocked it because the IP's from this source can solve Cloudflare challenges (and it's not a country I'd have members from).

This is an a little crude conclusion. It is not uncommon that ASNs have IPs in multiple countries. If that's the case depends from the business model of the ASN owner and often there are good and legitimate reasons for that. Look at the IP spaces of Google, IBM, Microsoft, Hetzner or OHV, to name just a few. On the other hand there are quite a couple of multinational ASNs that mainly cause trouble - UAB Bite Lietuva is one of them, but there are many more like Datacamp Ltd or 247 Europe. Just b/c an ASN owner has his business and/or IPs in a certain country this does not mean that users of that country would be affected - many ASNs do not serve as access points for real users - they may be data centers or just offer infrastructure. Also, just b/c an ASN has IPs in the US does not mean that it would necessarily be a residential proxy. The more, as the term "residential" in principle means a "home internet access", so typically a dialup. However: Blocking UAB the Lietuva does no harm - it has proven long enough that it is bad to the bone and does not carry legitimate users.

 

[Alvin63]

Blocking UAB the Lietuva does no harm - it has proven long enough that it is bad to the bone and does not carry legitimate users.

Yes

 

[Wildcat Media]

Most people dont type forum name/whats-new into a web browser.

I know quite a few who bookmark What's New in their browsers.

 

[smallwheels]

I know quite a few who bookmark What's New in their browsers.

I use autocomplete. ;-)

 

[Alvin63]

I know quite a few who bookmark What's New in their browsers.

That's a good point - presumably registered members though - they're exempted with xf_user so wouldn't be blocked from whats new. For genuine guests they get asked to register anyway after about 3 views due to an addon, so they'd have very little opportunity to click on whats-new. If they did click on it they would have a referer from whatever page they landed on so they wouldn't be blocked either. I think it's extremely low risks on my site, due to the addon - and due to the fact almost all members and genuine guests use mobile - mobile users would never be blocked.

 

[Alvin63]

I took a different approach to cf.client.bot and have stopped using it, because it contains over 700 verified allowed bots (https://radar.cloudflare.com/bots/directory), most of which are just noise. Instead, I now use as my first rule:

cf.client.bot and (
    lower(http.user_agent) contains "googlebot"
    or lower(http.user_agent) contains "bingbot"
    or lower(http.user_agent) contains "applebot"
    or lower(http.user_agent) contains "duckduckbot"
    or lower(http.user_agent) contains "bravebot"

    or lower(http.user_agent) contains "oai-searchbot"
    or lower(http.user_agent) contains "claude-searchbot"
    or lower(http.user_agent) contains "perplexitybot"

    or lower(http.user_agent) contains "chatgpt-user"
    or lower(http.user_agent) contains "claude-user"
    or lower(http.user_agent) contains "perplexity-user"
    or lower(http.user_agent) contains "google-agent"

    or lower(http.user_agent) contains "facebookexternalhit"
    or lower(http.user_agent) contains "linkedinbot"
    or lower(http.user_agent) contains "twitterbot"
    or lower(http.user_agent) contains "telegrambot"
    or lower(http.user_agent) contains "discordbot"
    or lower(http.user_agent) contains "slackbot"
    or lower(http.user_agent) contains "bingpreview"
    or lower(http.user_agent) contains "microsoftpreview"
    or lower(http.user_agent) contains "googleimageproxy"
)

Set to SKIP all other custom rules and bot protections.

Then my second rule is: (cf.client.bot) set to BLOCK

Then I have browser impersonators followed by search protection.

That allows all the relevant English bots access, along with AI user answers and major social media link embedding services. Everything else, blocked. Keeps that hungy META and AHREFS crap off the site, neither provide actual traffic.

Just coming back to this Anthony. I didn't do it initially because I have a registration addon that is from 2019 so it effectively blocks some of the newer cf.client bots so I basically only get the ones from before AI became a big thing and the main search bots. There are some pros to upgrading my addon to the latest version but the downside is it includes allowing the massive list of current verified bots. So if I did upgrade that addon I think I would need something like your skip rule because the list of fake bots to block would be too long and tedious to get right (ie bots faking the long list of current verified bots).

I understand how the skip rule allows the chosen verified bots to skip all rules, and then block cf.clientbot - but how does the fake browser rule then work and where does that come? Can it be in the same rule as blocking cf.clientbot? Because I can't get my head round it

So 1) Chosen verified bots skip - allowed on all rules basically 2) block cf client bot which blocks all the ones you haven't allowed. 3) then a list of real bot names to block as fakes (and not cf.clientbot). I can't work out how the fake bot list works. Take Googlebot for example. Googlebot is in the skip rule so ignores all rules. Then all other verified bots are blocked in the next rule. But to include Googlebot in the fake bots rule says block it if it's not cf.client bot - is that right? So the fake bots rule still works as it is? Or does it need to be altered?

Also presumably the only bots you need in the fake bots rule are the ones in the skip rule as all other verified bots are blocked anyway?

 

[Anthony Parsons]

but how does the fake browser rule then work and where does that come? Can it be in the same rule as blocking cf.clientbot?

They aren't the same thing. cf.client.bots is cloudflare approved list of verified companies who run bots through their service. It is not a list of good bots, its a list of companies bots, someone who has registered a business, created a bot for x purpose and they notify cloudflare of it to allow it through their service. Company bots don't mean evil, but it doesn't mean the bot serves any legit purpose for you either. If they did, then all the discussion on AI training bots here wouldn't exist. All AI companies, all with approved bots within cloudflare. Cloudflare only added an extra AI bot feature because they got so much backlash to help control them. They haven't done anything about Facebook crawlers doing the abuse they do. Its not really their problem, to be honest. Legit company, legit bot, people make a choice, not cloudflare.

Fake browser headers are all the private bots, some legit, most nasty, wanting to scrape your content or abuse your site. Those software systems can't accept and do all the things an actual browser can when a person visits a webpage (generally). Those header attributes (not normally captured in logging) give away all these anomalies. Like I've said pages back, and given what you need to capture, your default access logs DO NOT capture detailed header information. You need to adjust your logging so your access logs capture the data. Once you have that data, you can analyse it to differentiate real person vs automation. That is where the information comes from for that rule.

 

[Alvin63]

They aren't the same thing. cf.client.bots is cloudflare approved list of verified companies who run bots through their service. It is not a list of good bots, its a list of companies bots, someone who has registered a business, created a bot for x purpose and they notify cloudflare of it to allow it through their service. Company bots don't mean evil, but it doesn't mean the bot serves any legit purpose for you either. If they did, then all the discussion on AI training bots here wouldn't exist. All AI companies, all with approved bots within cloudflare. Cloudflare only added an extra AI bot feature because they got so much backlash to help control them. They haven't done anything about Facebook crawlers doing the abuse they do. Its not really their problem, to be honest. Legit company, legit bot, people make a choice, not cloudflare.

Fake browser headers are all the private bots, some legit, most nasty, wanting to scrape your content or abuse your site. Those software systems can't accept and do all the things an actual browser can when a person visits a webpage (generally). Those header attributes (not normally captured in logging) give away all these anomalies. Like I've said pages back, and given what you need to capture, your default access logs DO NOT capture detailed header information. You need to adjust your logging so your access logs capture the data. Once you have that data, you can analyse it to differentiate real person vs automation. That is where the information comes from for that rule.

Thanks. I didn't quite follow some of that sorry! But basically the list of verified bots in the updated addon I use for registration request, might not be the same as Cloudflare's verified bots anyway?