Crazy amount of guests

[Anthony Parsons]

I've begun to see more and more solve rates

Seeing that in CF too. My solve percentages are slowly climbing.

 

[smallwheels]

I've begun to see more and more solve rates from various ai-scrapers in the past three months on a challenge level of 4.

Seeing that in CF too. My solve percentages are slowly climbing.

This is bad news. Given that most of us use CF Turnstile at registrations as well as for site protection, either in CF itself or in add ons like IP Threat Manager or Bot Guard it is a huge problem when able to circumvent the CF challenge. Granted, CF will continue to improve their Captcha, yet it is a rat race and it would be good if there was an alternative that is at least as good and at least as non-annoying.

Regarding solve-rates for the CF Captacha: I am using it in combination with IP Threat Manager as well as during registration. For registration I found until now none that clearly looked fishy but one or two where I was/am somewhat suspicious.

Within IP Threat Manager solve rates vary massively day to day between 13% and 65%. I force challenge guests from my primary and secondary core countries, the rest is blocked anyway. So I assume the solve rate changes to a massive degree along with the amount of scrapers from those countries and this varies massively day to day: Regular guest traffic is pretty stable/constant while bot traffic changes dramatically. I can currently not say wether bots are able to solve the captcha as this would need sorrowful log analysis - something I am currently lacking the time to do.

 

[Waterfall]

Yeah, solve rates are climbing for me too, particularly for Linux and Chrome/151 and 152 I've also started getting a lot more old iOS version bots within the last day. I've set iOS 12-18 to Managed Challenge for logged out users and will monitor that.

 

[eva2000]

Has anyone given Cloudflare's Precursor a try yet? How have you been going with it?

Working nicely on my Cloudflare Enterprise plan though my custom WAF security rules probably caught them before Precursor did. But it's catching the junk URL path requests that aren't valid URLs

 

[Alvin63]

On the pro plan you can use snippets though - which is where I set up the honeypot. So I don't need precursor now Enterprise is very expensive.