Crazy amount of guests

[BrettC]

Thanks. I'm curious then - how do they solve a Cloudflare interactive challenge if they don't metaphorically "click" the button to say they are human? Presumably code to make it look clicked?

Anyway they are stopped again for now. The ones pretending to be multiple browsers and mobiles and faking referers can't solve cloudflare challenges, so they're being stopped by a challenge rule now. The rest that can solve cloudflare challenges are trapped in the honeypot. No doubt they will try something else.

I believe the bots running real browsers with playwright or puppeteer can click things, using javascript, which I assume is how they solve an interactive, tick box, cloudflare challenge.

There are clients that exist to mimic legitimate clients. Check out various topics with tagged repos on Github that exist for this very purpose:

• https://github.com/topics/cloudflare-solver
• https://github.com/topics/cloudflare-turnstile-bypass
• https://github.com/topics/cloudflare-challenge

Many, if not nearly all of the listed repos, are using Chromium in some form or fashion to do their dealings. Think of 'clicking' in this terminology as a phantom-click. The bots aren't actually clicking, they're deciphering the payload to solve, solves it, sends it back to CF for validation.

In the world of HTTP, it's either a GET or a POST - there isn't much else. Yes, yes, I know, OPTIONS and HEAD also exists, but that's aside this subject matter.

 

[Alvin63]

There are clients that exist to mimic legitimate clients. Check out various topics with tagged repos on Github that exist for this very purpose:

• https://github.com/topics/cloudflare-solver
• https://github.com/topics/cloudflare-turnstile-bypass
• https://github.com/topics/cloudflare-challenge

Many, if not nearly all of the listed repos, are using Chromium in some form or fashion to do their dealings. Think of 'clicking' in this terminology as a phantom-click. The bots aren't actually clicking, they're deciphering the payload to solve, solves it, sends it back to CF for validation.

In the world of HTTP, it's either a GET or a POST - there isn't much else. Yes, yes, I know, OPTIONS and HEAD also exists, but that's aside this subject matter.

Thank you for explaining that Can't believe cloudflare solver solutions are actually out there publicly (those links)!

 

[Alvin63]

In case this is useful to anyone else. Just blocked ASN 211590 - Bucklog SARL (France) scanner. One of it's IP's was the highest number of requests in the past day. It was probing for .git and .github files. Presumably didn't get anything on a Xenforo site? But it has a bad reputation after googling. The IP was 185.177.72.49. ASN as above.

 

[Alvin63]

"The standout deserves its own paragraph

BUCKLOG isn't just a number on our chart — GreyNoise did the deep forensic work on it and we're standing on their shoulders here. Their researchers documented AS211590 as a purpose-built, Kubernetes-orchestrated scanning fleet operating out of a single Paris range, generating on the order of 13 million sessions across 90 days, and in one tracked week throwing more than 33,000 HTTP requests at webhook endpoints — hunting file-upload paths, document-processing endpoints, and n8n workflow-automation instances via CVE-2026-21858. That is not a hosting company that happens to have a few bad tenants. The abuse is the product. The entire ASN is the weapon."

Volume Says AWS Is the Worst Host Alive. Abuse-Per-IP Says It's a 6-Month-Old Paris /24 Called BUCKLOG.

If you rank the autonomous systems in our blocklist by raw count, the worst actor on the internet appears to be Amazon.

www.dugganusa.com

Edit - It's been mentioned in this thread before on page 10 - apparently going direct to server IP in this case?

Thread 'Crazy amount of guests'

Oct 12, 2025

I have a small forum, usually a few hundred guests at most. The last days the number of guests have been unusually high, around 3000 and climbing. We now have over 4800 guests. That's not normal. Many "Viewing unknown page" or "Latest content", with a warning sign. IP addresses are from all corners of the world. Many from south America, Brazil mostly. Also saw quite a number from Vietnam of all places, but everywhere else too.

We're on Cloud and I don't know what to do. Could we be under attack? We have been in the past, a few times I think. For reasons I cannot possibly fathom; we're a...

• Levina
• bot swarms guests
• Replies: 1,903
• Forum: Forum management

•